{"items":[{"highlight":{"http.headers.server":"yawcam/0.8.0"},"data":{"ip":"216.110.242.50","isp":"Wightman Telecom","uri":"http://216.110.242.50:8081/","host_type":"ip","prot7":"http","target":{"ip":"216.110.242.50","type":"ip"},"geo":{"continent":"North America","country":"CA","city":"Stratford","tz":"America/Toronto","accuracy":5,"location":{"lon":-80.9523,"lat":43.3679},"postal":"N5A","registered_country":"CA","subdivisions":["Ontario"]},"path":"/","prot4":"tcp","protocol":"http","@timestamp":"2026-08-20T17:02:43.433Z","whois":{"abuse":"abuse@wightman.ca","related_nets":[],"net":{"country":"CA","address":"100 Elora Street North\nBox 70","city":"Clifford","created":"2004-01-28","range":"216.110.224.0 - 216.110.255.255","description":"Wightman Telecom","handle":"NET-216-110-224-0-1","organization":"Wightman Telecom (WIGHT)","name":"WIGHTMAN-04","start_ip":"216.110.224.0","net_size":8191,"cidr":["216.110.224.0/19"],"state":"ON","postal_code":"N0G-1M0","updated":"2012-03-02","end_ip":"216.110.255.255","contacts":{"emails":["ipadmin@corp.wightman.ca","abuse@wightman.ca","scott.cunningham@corp.wightman.ca","ipadmin@wightman.ca"],"phones":["+1-519-327-8012","+1-519-327-9662"]}},"asn":{"number":["29974"],"registry":"arin","country":"CA","name":"WIGHT-AS - Wightman Telecom","cidr":"216.110.242.0/24","updated":"2004-01-28"}},"port":8081,"host":"216.110.242.50","http":{"headers":{"server":["yawcam/0.8.0"],"content_type":["text/html"],"content_length":["18956"]},"status_code":200,"body_sha256":"a456a90024761592ebd6dbcb81a0ca52516d2a3d2a4a74d53ed5719909e64ecc","unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"status_line":"200 OK","body":"\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\t

\t\r\n \t

\r\n\t

\t\r\n\t

\r\n\t\r\n\t

\t\r\n\t\r\n\t

\r\n\t\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\r\n","title":"","version":"1.1","content_length":18956},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.8.0"},"data":{"ip":"210.62.196.80","isp":"GCNet Reach & Range","uri":"http://210.62.196.80:8081/","host_type":"ip","target":{"ip":"210.62.196.80","type":"ip"},"prot7":"http","geo":{"continent":"Asia","country":"TW","tz":"Asia/Taipei","accuracy":200,"location":{"lon":121.0,"lat":24.0},"registered_country":"TW"},"path":"/","prot4":"tcp","protocol":"http","@timestamp":"2026-08-20T11:08:54.706Z","port":8081,"whois":{"abuse":"hostmaster@twnic.tw","related_nets":[{"country":"TW","start_ip":"210.62.192.0","description":"GCNet (Reach & Range Inc.)","range":"210.62.192.0 - 210.62.223.255","net_size":8191,"cidr":["210.62.192.0/19"],"updated":"2008-09-04T07:54:28Z","end_ip":"210.62.223.255","contacts":{"emails":["antispam@gcn.net.tw","abuse@gcn.net.tw","uwewu@gcn.net.tw"]}},{"country":"TW","address":"Reach & Range Inc.\n7F, No.139, Cheng Chou Rd.\nTaipei Taiwan","name":"GCNET-RR06-NET","start_ip":"210.62.196.0","description":"Reach & Range Inc.\n5F, 206, Sec.1, Keelung Rd.,\nTaipei Taiwan","range":"210.62.196.0 - 210.62.196.255","handle":"MC14-TW","cidr":["210.62.196.0/24"],"net_size":255,"end_ip":"210.62.196.255","contacts":{"emails":["nickchang@taiwanmobile.com","twnic@gcn.net.tw","hostmaster@twnic.net"],"persons":["GCNet NOC"],"phones":["+886-2-2549-6877"]}}],"net":{"country":"TW","address":"3F., No. 123, Sec. 4, Bade Rd., Songshan Dist., Taipei 105, Taiwan","name":"GCN-TW","start_ip":"210.62.192.0","description":"Global Communication Network Corp.\nInternet Gateway Service and Reselling Service Provider","range":"210.62.192.0 - 210.62.223.255","handle":"AT939-AP","cidr":["210.62.192.0/19"],"net_size":8191,"updated":"2021-11-04T00:49:38Z","end_ip":"210.62.223.255","contacts":{"emails":["hostmaster@twnic.tw","eric1107@gcn.net.tw","pywang@ignmail.gcn.net.tw"],"persons":["Eric Lin Jyh-ching","P Y Wang"],"phones":["+000000000","+886-2-2549-6877 ext.228","+886 2 7756099"]}},"asn":{"country":"TW","number":["18049"],"registry":"apnic","name":"TINP-TW - Taiwan Infrastructure Network Technologie","cidr":"210.62.192.0/20","updated":"1997-08-29"}},"host":"210.62.196.80","http":{"headers":{"server":["yawcam/0.8.0"],"content_type":["text/html"],"content_length":["19007"]},"status_code":200,"body_sha256":"e832481c570e8d484b7f1d4a518999eb27563ca8e2b6c50cff557936608b39fa","unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"status_line":"200 OK","title":"Yawcam","body":"\r\n\r\n\r\n\r\nYawcam\r\n\r\n\r\n\r\n\r\n\r\n\r\n\t

\t\r\n \t

\" �� Coco �� v �� J �� C \" - Catherine

\r\n\t

\t\r\n\t

\r\n\t\r\n\t

\t\r\n\t\r\n\t

\r\n\t\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n","version":"1.1","content_length":19007},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.8.0"},"data":{"ip":"210.62.196.80","isp":"GCNet Reach & Range","uri":"http://210.62.196.80:8888/","host_type":"ip","target":{"ip":"210.62.196.80","type":"ip"},"prot7":"http","geo":{"continent":"Asia","country":"TW","tz":"Asia/Taipei","accuracy":200,"location":{"lon":121.0,"lat":24.0},"registered_country":"TW"},"path":"/","prot4":"tcp","protocol":"http","@timestamp":"2026-08-20T11:08:07.142Z","port":8888,"whois":{"abuse":"hostmaster@twnic.tw","related_nets":[{"country":"TW","start_ip":"210.62.192.0","description":"GCNet (Reach & Range Inc.)","range":"210.62.192.0 - 210.62.223.255","net_size":8191,"cidr":["210.62.192.0/19"],"updated":"2008-09-04T07:54:28Z","end_ip":"210.62.223.255","contacts":{"emails":["antispam@gcn.net.tw","abuse@gcn.net.tw","uwewu@gcn.net.tw"]}},{"country":"TW","address":"Reach & Range Inc.\n7F, No.139, Cheng Chou Rd.\nTaipei Taiwan","name":"GCNET-RR06-NET","start_ip":"210.62.196.0","description":"Reach & Range Inc.\n5F, 206, Sec.1, Keelung Rd.,\nTaipei Taiwan","range":"210.62.196.0 - 210.62.196.255","handle":"MC14-TW","cidr":["210.62.196.0/24"],"net_size":255,"end_ip":"210.62.196.255","contacts":{"emails":["nickchang@taiwanmobile.com","twnic@gcn.net.tw","hostmaster@twnic.net"],"persons":["GCNet NOC"],"phones":["+886-2-2549-6877"]}}],"net":{"country":"TW","address":"3F., No. 123, Sec. 4, Bade Rd., Songshan Dist., Taipei 105, Taiwan","name":"GCN-TW","start_ip":"210.62.192.0","description":"Global Communication Network Corp.\nInternet Gateway Service and Reselling Service Provider","range":"210.62.192.0 - 210.62.223.255","handle":"AT939-AP","cidr":["210.62.192.0/19"],"net_size":8191,"updated":"2021-11-04T00:49:38Z","end_ip":"210.62.223.255","contacts":{"emails":["hostmaster@twnic.tw","eric1107@gcn.net.tw","pywang@ignmail.gcn.net.tw"],"persons":["Eric Lin Jyh-ching","P Y Wang"],"phones":["+000000000","+886-2-2549-6877 ext.228","+886 2 7756099"]}},"asn":{"country":"TW","number":["18049"],"registry":"apnic","name":"TINP-TW - Taiwan Infrastructure Network Technologie","cidr":"210.62.192.0/20","updated":"1997-08-29"}},"host":"210.62.196.80","http":{"headers":{"server":["yawcam/0.8.0"],"content_type":["text/html"],"content_length":["538"]},"status_code":200,"favicon":{"hash_sha256":"0249fe613cf2cd48dac01cbe2c9f0aab2d59d5dc78e4efb70a08d45ce16ba3c4","path":"/favicon.ico","image":"AAABAAEAEBAAAAEAGABoAwAAFgAAACgAAAAQAAAAIAAAAAEAGAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAADk5OTg4ODe3t7f39/g4OHh4eHi4uLk5ebn6err7e7a3Ny7u7y9vb3Ozs7p6en9/f3W19bb29zh4eHl5eXo6Ojq6+vg4OHBuLWsmZGsmpLKw7/h4uPg4OH6+vr9/f3////a2tvi4uLo6Ojt7e3x8vLd29qoi3+OWkWOUzmHSzGBTTiojoLd3d3t7e7////////f397m5ubt7e309fXr6+q1mo6UVTufZEalaEqjYUWbWj2UWz6plInl5ub4+Pj////h4eHp6enw8PD6/PzTyMKRVj6pbk2ZaExYKRxXJRqlb1SudFSSYUjFv7zp6ur////h4eHp6enx8fH5/P27pJiMSSymbk1aNCQfAQAjBQFZLB+xdVeRVzurnpfb3d719fXg4ODn6Ojv7/D2+fq4opeSUzaqcFBQKBohAgAhBABRKBuwdleCSC+ilY/Mz9Dn5+fd3dzk5OTr6+v09vfHuLKHTjSjYkN8RS9RLCNAHBKPXEGuclB+TTeqpKG/wcHf39/Y2Njf39/l5eXr6+zi4eCaeGmMSi6iX0C+inKud1ilZkWKUDSTe3C2t7e2trbX19fS0tLY2Njd3t7h4eLl5ufT0M6dfW2LUjmAOyKJSS57SjOYf3S3trazs7SwsLDS0tLLy8vR0dHV1dXY2Njb29vc3d7T09O7sKqnk4ujkYmwqaW8vb23uLmtra2rq6vPz8/Dw8PIyMjNzc3Q0NDS0tLT0tLS0tPR09TO0NHIy8zBwsO5uLmwsbGoqKioqKnQ0NDAwMDLy8rU09TY2Nja2tra2trY2NjS0tLJycm+vr62trawsLCqqqqioqKpqanV1dXS0tLc3Nzj4+Pn5+fp6enp6enm5ubh4OHZ2dnOzs67u7uqqqqjo6OdnZ2ysbHf39/b29vi4uLp6env7+/y8vLx8fHt7e3n5+fg4ODZ2dnOzs61tbWcnJybm5vBwcHt7e3d3d3l5eXu7u709fX4+Pj4+Pjy8/Ls7Ozj4+Pb29vV1dXFxcWenp6pqanW1tb+/v4AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//","perceptual_hash":"fdfdf1e1c1c1e3ff","ip":"210.62.196.80","host":"210.62.196.80","uri":"http://210.62.196.80:8888/favicon.ico"},"body_sha256":"5a3b39f2a032a99758374ec3e5c0afbc810d0aa581d213d541536b5d9a93e894","meta":["http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\""],"unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"status_line":"200 OK","body":"\r\n\r\n\r\nYawcam\r\n\r\n\r\n\r\n\r\n

\r\n

It's \r\n a webcam!

\r\n

www.yawcam.com

\r\n

\r\n\r\n\r\n","title":"Yawcam","version":"1.1","content_length":538},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.3.3"},"data":{"ip":"219.89.192.95","isp":"Spark New Zealand","uri":"http://219.89.192.95:80/","host_type":"ip","target":{"ip":"219.89.192.95","type":"ip"},"prot7":"http","geo":{"continent":"Oceania","country":"NZ","city":"Auckland","tz":"Pacific/Auckland","accuracy":200,"location":{"lon":174.7679,"lat":-36.8506},"postal":"1010","registered_country":"NZ","subdivisions":["Auckland"]},"path":"/","protocol":"http","prot4":"tcp","@timestamp":"2026-08-20T10:18:04.796Z","whois":{"abuse":"abuse@xtra.co.nz","related_nets":[],"net":{"country":"NZ","address":"Spark New Zealand Trading Ltd\n31 Airedale Street\nAuckland\nNew Zealand","name":"TIS-NZ","start_ip":"219.89.0.0","range":"219.89.0.0 - 219.89.255.255","description":"Spark New Zealand Trading Ltd","cidr":["219.89.0.0/16"],"handle":"AS2483-AP","net_size":65535,"end_ip":"219.89.255.255","updated":"2021-01-10T22:10:28Z","contacts":{"emails":["ipadmin@team.xtra.co.nz","sir@spark.co.nz","abuse@xtra.co.nz"],"persons":["IP Administrator"],"phones":["+000000000","+64-7-839-6195"]}},"asn":{"number":["4771"],"registry":"apnic","country":"NZ","name":"SPARKNZ - Spark New Zealand Trading Ltd.","cidr":"219.89.0.0/21","updated":"2003-01-06"}},"port":80,"host":"219.89.192.95","http":{"headers":{"server":["yawcam/0.3.3"],"content_type":["text/html"],"content_length":["17092"]},"status_code":200,"body_sha256":"7cdc8693249f03cda8c64e10904ca93cba1064df856f4991955924cec8c28001","unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"title":" Compu Print","body":"\r\n\r\n\r\n\r\n Compu Print\r\n\r\n\r\n\r\n\r\n\r\n\r\n\t

\t\r\n \t

Compu Print

\r\n\t

\t\r\n\t

\r\n\t\r\n\t

\r\n\t\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\r\n","status_line":"200 OK","version":"1.1","content_length":17092},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.3.3"},"data":{"ip":"219.89.192.95","isp":"Spark New Zealand","uri":"http://219.89.192.95:8888/","host_type":"ip","prot7":"http","target":{"ip":"219.89.192.95","type":"ip"},"geo":{"continent":"Oceania","country":"NZ","city":"Auckland","tz":"Pacific/Auckland","accuracy":200,"location":{"lon":174.7679,"lat":-36.8506},"postal":"1010","registered_country":"NZ","subdivisions":["Auckland"]},"path":"/","protocol":"http","prot4":"tcp","@timestamp":"2026-08-20T10:17:51.391Z","whois":{"abuse":"abuse@xtra.co.nz","related_nets":[],"net":{"country":"NZ","address":"Spark New Zealand Trading Ltd\n31 Airedale Street\nAuckland\nNew Zealand","start_ip":"219.89.0.0","name":"TIS-NZ","range":"219.89.0.0 - 219.89.255.255","description":"Spark New Zealand Trading Ltd","cidr":["219.89.0.0/16"],"handle":"AS2483-AP","net_size":65535,"end_ip":"219.89.255.255","updated":"2021-01-10T22:10:28Z","contacts":{"emails":["ipadmin@team.xtra.co.nz","sir@spark.co.nz","abuse@xtra.co.nz"],"persons":["IP Administrator"],"phones":["+000000000","+64-7-839-6195"]}},"asn":{"number":["4771"],"registry":"apnic","country":"NZ","name":"SPARKNZ - Spark New Zealand Trading Ltd.","cidr":"219.89.0.0/21","updated":"2003-01-06"}},"port":8888,"host":"219.89.192.95","http":{"headers":{"server":["yawcam/0.3.3"],"content_type":["text/html"],"content_length":["529"]},"status_code":200,"body_sha256":"b5afdb99c007a567ee4e84502236c41a5b7f9b3697bd6681a6d8f5e026b67192","meta":["http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\""],"unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"title":"Yawcam","status_line":"200 OK","body":"\r\n\r\n\r\nYawcam\r\n\r\n\r\n\r\n\r\n

\r\n

Compu Print

\r\n

www.yawcam.com

\r\n

\r\n\r\n\r\n","version":"1.1","content_length":529},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.8.0"},"data":{"ip":"220.71.1.237","isp":"Korea Telecom","uri":"http://220.71.1.237:8081/","host_type":"ip","prot7":"http","target":{"ip":"220.71.1.237","type":"ip"},"geo":{"continent":"Asia","country":"KR","city":"Yongsan-gu","tz":"Asia/Seoul","accuracy":5,"location":{"lon":126.9754,"lat":37.5794},"postal":"044","registered_country":"KR","subdivisions":["Seoul"]},"path":"/","prot4":"tcp","protocol":"http","@timestamp":"2026-08-20T06:48:50.515Z","whois":{"abuse":"irt@nic.or.kr","related_nets":[{"country":"KR","address":"Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90\nKT Head Office","name":"KORNET-KR","start_ip":"220.70.0.0","range":"220.70.0.0 - 220.71.255.255","description":"Korea Telecom","net_size":131071,"handle":"IA9-KR","cidr":["220.70.0.0/15"],"end_ip":"220.71.255.255","contacts":{"emails":["hostmaster@nic.or.kr","kornet_ip@kt.com"],"persons":["IP Manager"],"phones":["+82-2-500-6630"]}}],"net":{"country":"KR","address":"9, Jinheung-gil, Naju-si, Jeollanam-do","name":"KORNET","start_ip":"220.70.0.0","range":"220.70.0.0 - 220.71.255.255","description":"Korea Telecom","net_size":131071,"handle":"IM667-AP","cidr":["220.70.0.0/15"],"updated":"2017-02-06T02:32:47Z","end_ip":"220.71.255.255","contacts":{"emails":["irt@nic.or.kr","kornet_ip@kt.com"],"persons":["IP Manager"],"phones":["+82-2-500-6630"]}},"asn":{"number":["4766"],"registry":"apnic","country":"KR","name":"KIXS-AS-KR-KR - Korea Telecom","cidr":"220.70.0.0/15","updated":"2002-07-22"}},"port":8081,"host":"220.71.1.237","http":{"headers":{"server":["yawcam/0.8.0"],"content_type":["text/html"],"content_length":["18976"]},"status_code":200,"body_sha256":"a703f66a732d32c05d7075e74c478e7fc49fb99fd88324fa79f956ca2d5d830f","favicon":{"hash_sha256":"0249fe613cf2cd48dac01cbe2c9f0aab2d59d5dc78e4efb70a08d45ce16ba3c4","path":"/favicon.ico","image":"AAABAAEAEBAAAAEAGABoAwAAFgAAACgAAAAQAAAAIAAAAAEAGAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAADk5OTg4ODe3t7f39/g4OHh4eHi4uLk5ebn6err7e7a3Ny7u7y9vb3Ozs7p6en9/f3W19bb29zh4eHl5eXo6Ojq6+vg4OHBuLWsmZGsmpLKw7/h4uPg4OH6+vr9/f3////a2tvi4uLo6Ojt7e3x8vLd29qoi3+OWkWOUzmHSzGBTTiojoLd3d3t7e7////////f397m5ubt7e309fXr6+q1mo6UVTufZEalaEqjYUWbWj2UWz6plInl5ub4+Pj////h4eHp6enw8PD6/PzTyMKRVj6pbk2ZaExYKRxXJRqlb1SudFSSYUjFv7zp6ur////h4eHp6enx8fH5/P27pJiMSSymbk1aNCQfAQAjBQFZLB+xdVeRVzurnpfb3d719fXg4ODn6Ojv7/D2+fq4opeSUzaqcFBQKBohAgAhBABRKBuwdleCSC+ilY/Mz9Dn5+fd3dzk5OTr6+v09vfHuLKHTjSjYkN8RS9RLCNAHBKPXEGuclB+TTeqpKG/wcHf39/Y2Njf39/l5eXr6+zi4eCaeGmMSi6iX0C+inKud1ilZkWKUDSTe3C2t7e2trbX19fS0tLY2Njd3t7h4eLl5ufT0M6dfW2LUjmAOyKJSS57SjOYf3S3trazs7SwsLDS0tLLy8vR0dHV1dXY2Njb29vc3d7T09O7sKqnk4ujkYmwqaW8vb23uLmtra2rq6vPz8/Dw8PIyMjNzc3Q0NDS0tLT0tLS0tPR09TO0NHIy8zBwsO5uLmwsbGoqKioqKnQ0NDAwMDLy8rU09TY2Nja2tra2trY2NjS0tLJycm+vr62trawsLCqqqqioqKpqanV1dXS0tLc3Nzj4+Pn5+fp6enp6enm5ubh4OHZ2dnOzs67u7uqqqqjo6OdnZ2ysbHf39/b29vi4uLp6env7+/y8vLx8fHt7e3n5+fg4ODZ2dnOzs61tbWcnJybm5vBwcHt7e3d3d3l5eXu7u709fX4+Pj4+Pjy8/Ls7Ozj4+Pb29vV1dXFxcWenp6pqanW1tb+/v4AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//","perceptual_hash":"fdfdf1e1c1c1e3ff","ip":"220.71.1.237","host":"220.71.1.237","uri":"http://220.71.1.237:8081/favicon.ico"},"unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"status_line":"200 OK","body":"\r\n\r\n\r\n\r\nYawcam\r\n\r\n\r\n\r\n\r\n\r\n\r\n\t

\t\r\n \t

It's a webcam!

\r\n\t

\t\r\n\t

\r\n\t\r\n\t

\t\r\n\t\r\n\t

\r\n\t\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\t\r\n\r\n\r\n","title":"Yawcam","version":"1.1","content_length":18976},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.8.0"},"data":{"ip":"220.71.1.237","isp":"Korea Telecom","uri":"http://220.71.1.237:8888/","host_type":"ip","prot7":"http","target":{"ip":"220.71.1.237","type":"ip"},"geo":{"continent":"Asia","country":"KR","city":"Yongsan-gu","tz":"Asia/Seoul","accuracy":5,"location":{"lon":126.9754,"lat":37.5794},"postal":"044","registered_country":"KR","subdivisions":["Seoul"]},"path":"/","protocol":"http","prot4":"tcp","@timestamp":"2026-08-20T06:48:42.688Z","whois":{"abuse":"irt@nic.or.kr","related_nets":[{"country":"KR","address":"Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90\nKT Head Office","start_ip":"220.70.0.0","name":"KORNET-KR","range":"220.70.0.0 - 220.71.255.255","description":"Korea Telecom","cidr":["220.70.0.0/15"],"handle":"IA9-KR","net_size":131071,"end_ip":"220.71.255.255","contacts":{"emails":["hostmaster@nic.or.kr","kornet_ip@kt.com"],"persons":["IP Manager"],"phones":["+82-2-500-6630"]}}],"net":{"country":"KR","address":"9, Jinheung-gil, Naju-si, Jeollanam-do","start_ip":"220.70.0.0","name":"KORNET","range":"220.70.0.0 - 220.71.255.255","description":"Korea Telecom","cidr":["220.70.0.0/15"],"handle":"IM667-AP","net_size":131071,"end_ip":"220.71.255.255","updated":"2017-02-06T02:32:47Z","contacts":{"emails":["irt@nic.or.kr","kornet_ip@kt.com"],"persons":["IP Manager"],"phones":["+82-2-500-6630"]}},"asn":{"number":["4766"],"registry":"apnic","country":"KR","name":"KIXS-AS-KR-KR - Korea Telecom","cidr":"220.70.0.0/15","updated":"2002-07-22"}},"port":8888,"host":"220.71.1.237","http":{"headers":{"server":["yawcam/0.8.0"],"content_type":["text/html"],"content_length":["538"]},"status_code":200,"favicon":{"hash_sha256":"0249fe613cf2cd48dac01cbe2c9f0aab2d59d5dc78e4efb70a08d45ce16ba3c4","image":"AAABAAEAEBAAAAEAGABoAwAAFgAAACgAAAAQAAAAIAAAAAEAGAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAADk5OTg4ODe3t7f39/g4OHh4eHi4uLk5ebn6err7e7a3Ny7u7y9vb3Ozs7p6en9/f3W19bb29zh4eHl5eXo6Ojq6+vg4OHBuLWsmZGsmpLKw7/h4uPg4OH6+vr9/f3////a2tvi4uLo6Ojt7e3x8vLd29qoi3+OWkWOUzmHSzGBTTiojoLd3d3t7e7////////f397m5ubt7e309fXr6+q1mo6UVTufZEalaEqjYUWbWj2UWz6plInl5ub4+Pj////h4eHp6enw8PD6/PzTyMKRVj6pbk2ZaExYKRxXJRqlb1SudFSSYUjFv7zp6ur////h4eHp6enx8fH5/P27pJiMSSymbk1aNCQfAQAjBQFZLB+xdVeRVzurnpfb3d719fXg4ODn6Ojv7/D2+fq4opeSUzaqcFBQKBohAgAhBABRKBuwdleCSC+ilY/Mz9Dn5+fd3dzk5OTr6+v09vfHuLKHTjSjYkN8RS9RLCNAHBKPXEGuclB+TTeqpKG/wcHf39/Y2Njf39/l5eXr6+zi4eCaeGmMSi6iX0C+inKud1ilZkWKUDSTe3C2t7e2trbX19fS0tLY2Njd3t7h4eLl5ufT0M6dfW2LUjmAOyKJSS57SjOYf3S3trazs7SwsLDS0tLLy8vR0dHV1dXY2Njb29vc3d7T09O7sKqnk4ujkYmwqaW8vb23uLmtra2rq6vPz8/Dw8PIyMjNzc3Q0NDS0tLT0tLS0tPR09TO0NHIy8zBwsO5uLmwsbGoqKioqKnQ0NDAwMDLy8rU09TY2Nja2tra2trY2NjS0tLJycm+vr62trawsLCqqqqioqKpqanV1dXS0tLc3Nzj4+Pn5+fp6enp6enm5ubh4OHZ2dnOzs67u7uqqqqjo6OdnZ2ysbHf39/b29vi4uLp6env7+/y8vLx8fHt7e3n5+fg4ODZ2dnOzs61tbWcnJybm5vBwcHt7e3d3d3l5eXu7u709fX4+Pj4+Pjy8/Ls7Ozj4+Pb29vV1dXFxcWenp6pqanW1tb+/v4AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//","path":"/favicon.ico","perceptual_hash":"fdfdf1e1c1c1e3ff","ip":"220.71.1.237","host":"220.71.1.237","uri":"http://220.71.1.237:8888/favicon.ico"},"body_sha256":"5a3b39f2a032a99758374ec3e5c0afbc810d0aa581d213d541536b5d9a93e894","meta":["http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\""],"unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"title":"Yawcam","status_line":"200 OK","body":"\r\n\r\n\r\nYawcam\r\n\r\n\r\n\r\n\r\n

\r\n

It's \r\n a webcam!

\r\n

www.yawcam.com

\r\n

\r\n\r\n\r\n","version":"1.1","content_length":538},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.8.0"},"data":{"isp":"Spark New Zealand","ip":"222.154.233.61","uri":"http://222.154.233.61:8888/","host_type":"ip","prot7":"http","target":{"ip":"222.154.233.61","type":"ip"},"geo":{"continent":"Oceania","country":"NZ","city":"Auckland","tz":"Pacific/Auckland","accuracy":500,"location":{"lon":174.7679,"lat":-36.8506},"postal":"1010","registered_country":"NZ","subdivisions":["Auckland"]},"path":"/","prot4":"tcp","protocol":"http","@timestamp":"2026-08-20T04:24:36.182Z","whois":{"abuse":"abuse@xtra.co.nz","related_nets":[],"net":{"country":"NZ","address":"Spark New Zealand Trading Ltd\n31 Airedale Street\nAuckland\nNew Zealand","description":"SPARK NEW ZEALAND TRADING LIMITED","range":"222.152.0.0 - 222.155.255.255","handle":"AS2483-AP","organization":"ORG-SNZT1-AP","start_ip":"222.152.0.0","name":"SPARKNZ","net_size":262143,"cidr":["222.152.0.0/14"],"updated":"2020-07-07T04:59:14Z","end_ip":"222.155.255.255","contacts":{"emails":["hostmaster@apnic.net","sir@spark.co.nz","abuse@xtra.co.nz","SparkNZInternetRegistry@spark.co.nz"],"persons":["IP Administrator"],"phones":["+64-4-498-9159","+000000000","+64-7-839-6195"]}},"asn":{"country":"NZ","registry":"apnic","number":["4771"],"name":"SPARKNZ - Spark New Zealand Trading Ltd.","cidr":"222.154.224.0/19","updated":"2004-12-01"}},"port":8888,"host":"222.154.233.61","http":{"headers":{"server":["yawcam/0.8.0"],"content_type":["text/html"],"content_length":["538"]},"status_code":200,"favicon":{"hash_sha256":"0249fe613cf2cd48dac01cbe2c9f0aab2d59d5dc78e4efb70a08d45ce16ba3c4","path":"/favicon.ico","image":"AAABAAEAEBAAAAEAGABoAwAAFgAAACgAAAAQAAAAIAAAAAEAGAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAADk5OTg4ODe3t7f39/g4OHh4eHi4uLk5ebn6err7e7a3Ny7u7y9vb3Ozs7p6en9/f3W19bb29zh4eHl5eXo6Ojq6+vg4OHBuLWsmZGsmpLKw7/h4uPg4OH6+vr9/f3////a2tvi4uLo6Ojt7e3x8vLd29qoi3+OWkWOUzmHSzGBTTiojoLd3d3t7e7////////f397m5ubt7e309fXr6+q1mo6UVTufZEalaEqjYUWbWj2UWz6plInl5ub4+Pj////h4eHp6enw8PD6/PzTyMKRVj6pbk2ZaExYKRxXJRqlb1SudFSSYUjFv7zp6ur////h4eHp6enx8fH5/P27pJiMSSymbk1aNCQfAQAjBQFZLB+xdVeRVzurnpfb3d719fXg4ODn6Ojv7/D2+fq4opeSUzaqcFBQKBohAgAhBABRKBuwdleCSC+ilY/Mz9Dn5+fd3dzk5OTr6+v09vfHuLKHTjSjYkN8RS9RLCNAHBKPXEGuclB+TTeqpKG/wcHf39/Y2Njf39/l5eXr6+zi4eCaeGmMSi6iX0C+inKud1ilZkWKUDSTe3C2t7e2trbX19fS0tLY2Njd3t7h4eLl5ufT0M6dfW2LUjmAOyKJSS57SjOYf3S3trazs7SwsLDS0tLLy8vR0dHV1dXY2Njb29vc3d7T09O7sKqnk4ujkYmwqaW8vb23uLmtra2rq6vPz8/Dw8PIyMjNzc3Q0NDS0tLT0tLS0tPR09TO0NHIy8zBwsO5uLmwsbGoqKioqKnQ0NDAwMDLy8rU09TY2Nja2tra2trY2NjS0tLJycm+vr62trawsLCqqqqioqKpqanV1dXS0tLc3Nzj4+Pn5+fp6enp6enm5ubh4OHZ2dnOzs67u7uqqqqjo6OdnZ2ysbHf39/b29vi4uLp6env7+/y8vLx8fHt7e3n5+fg4ODZ2dnOzs61tbWcnJybm5vBwcHt7e3d3d3l5eXu7u709fX4+Pj4+Pjy8/Ls7Ozj4+Pb29vV1dXFxcWenp6pqanW1tb+/v4AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAP//","perceptual_hash":"fdfdf1e1c1c1e3ff","ip":"222.154.233.61","host":"222.154.233.61","uri":"http://222.154.233.61:8888/favicon.ico"},"body_sha256":"5a3b39f2a032a99758374ec3e5c0afbc810d0aa581d213d541536b5d9a93e894","meta":["http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\""],"unknown_headers":[{"value":["text/html"],"key":"mime_type"}],"body":"\r\n\r\n\r\nYawcam\r\n\r\n\r\n\r\n\r\n

\r\n

It's \r\n a webcam!

\r\n

www.yawcam.com

\r\n

\r\n\r\n\r\n","title":"Yawcam","status_line":"200 OK","version":"1.1","content_length":538},"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"jarm":"2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261","ip":"212.111.43.4","isp":"Akamai Connected Cloud","certificate":{"issuer_dn":"C=AU, ST=Some-State, O=Internet Widgits Pty Ltd","fingerprint_md5":"2eefe7a05c8450c24d308185da925133","signature":{"valid":true,"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"self_signed":true,"value":"U1yGpNowsoFvcltCedbPwtfkgfaLyDwluZxE/cyVjygl0ORbjXyhq0oTnpxv41dNiuvbX5jkqLXn7SnvQ6OMn2PhVypOEbAUupdi0ljGrrnA/EYmEbHkKzVk+gQ67zLWDO/IOl0qKGE+uPjv6tCLwuYXcQQU8K8Ln+zgKBJEbzVjkw2JBU5RC0LclLF7cKijsVeoy7wEFtVnIQvbiaGwMlplH8R6eCj6llxkw8rxXKP81nSqw/UoRDeBL7kTuqtNbWzn7jWnduX1F/NbidEMmCiVjOkrvaXbgBOBUmwsJUlhLVNDvEdlI55egZ8V6AK+ea3oPVa+1+6xnorhyEM1OhpWajA/3SedZQua38YVK/jL4xs4nP/4HKXuYuD1XXNNBw9/eRPS1RGaL40gJdlxGKSRLlTWF83e0bC/1ezNR+rYHSdGD2FVqonPbpK2nNycMY9SXDpCIpiDekz4VwU59L38/34Ov8jBk3qvBo3WSrQtBM0YC9jkhsK5d/vKi1MFX7zcaxijWdxgkmaVjVCRdt8Lx8kCLIKIaSuxjIh+DzrGSo+CYtFiKU7j18/4OSQWR7QFrnH9TYsnYPLRYD3kqp2GloFDeLqe669ovAlwA4Q8hKOKNLsaVXFGpOhKqwmxxMUUAVgbixFM6tcjtEWmdyY6HwMsPBple1GVI/LYISo="},"redacted":false,"src":"https://212.111.43.4:443/","subject":{"country":["AU"],"province":["Some-State"],"organization":["Internet Widgits Pty Ltd"]},"serial_number":"617747481304547497522122752841426590323176705745","version":3,"issuer":{"country":["AU"],"province":["Some-State"],"organization":["Internet Widgits Pty Ltd"]},"tbs_noct_fingerprint":"5ffc73be8aab8d893c6930b1400b89f100a7479015180531b9413a99ce45cedb","fingerprint_sha256":"22c751569a296b1a7f371a763cae6159f9231ba34ed6479a5e8b58c634b3321c","extensions":{"subject_key_id":"4d8d3fa87c0dffd3a576e45af33fa722f3c4ac98","authority_key_id":"4d8d3fa87c0dffd3a576e45af33fa722f3c4ac98","basic_constraints":{"is_ca":true}},"tbs_fingerprint":"5ffc73be8aab8d893c6930b1400b89f100a7479015180531b9413a99ce45cedb","subject_dn":"C=AU, ST=Some-State, O=Internet Widgits Pty Ltd","fingerprint_sha1":"c798e998654e5a23893563847fbb3ca079210955","spki_subject_fingerprint":"c78d715f40c8c1f9c6cbea8cd0fbd6bfbb2729052a009f50cf7611ac71b283cc","validity":{"length":31536000,"start":"2026-08-13T09:43:21Z","end":"2027-08-13T09:43:21Z"},"validation_level":"unknown"},"uri":"https://212.111.43.4:443/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","protocol":"https","prot4":"tcp","cve":[{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"LOW","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"COMPLETE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"LOW","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:15.363Z","whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","range":"212.111.40.0 - 212.111.43.255","description":"Linode","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2014-08-15T14:26:31Z"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","range":"212.111.40.0 - 212.111.43.255","description":"Akamai Technologies","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2025-04-28T14:29:55Z"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2022-12-07T14:29:12Z","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"number":["63949"],"registry":"ripencc","country":"US","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"port":443,"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:59 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"title":"28ZE","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","status_line":"200 OK","version":"1.1","content_length":56889},"tag":[{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"name":"indy","fullname":"Indy","indy":{"version":"9.0.11"},"category":["Web servers"]},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","mochiweb":{"version":"1.0"},"category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","windows_ce":{"version":""},"category":["Operating systems"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","flask":{"version":"0.9.6"},"category":["Web frameworks","Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","perl":{"version":""},"fullname":"Perl","category":["Programming languages"]},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"description":"PHP is a general-purpose scripting language used for web development.","php":{"version":"7.3.11"},"fullname":"PHP","category":["Programming languages"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","fullname":"Web Viewer for Samsung DVR","samsung_dvr":{"version":""},"category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"isp":"Akamai Connected Cloud","ip":"212.111.43.4","certificate":{"issuer_dn":"C=AU, ST=Some-State, O=Internet Widgits Pty Ltd","fingerprint_md5":"2eefe7a05c8450c24d308185da925133","src":"https://212.111.43.4:8443/","redacted":false,"signature":{"valid":true,"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"U1yGpNowsoFvcltCedbPwtfkgfaLyDwluZxE/cyVjygl0ORbjXyhq0oTnpxv41dNiuvbX5jkqLXn7SnvQ6OMn2PhVypOEbAUupdi0ljGrrnA/EYmEbHkKzVk+gQ67zLWDO/IOl0qKGE+uPjv6tCLwuYXcQQU8K8Ln+zgKBJEbzVjkw2JBU5RC0LclLF7cKijsVeoy7wEFtVnIQvbiaGwMlplH8R6eCj6llxkw8rxXKP81nSqw/UoRDeBL7kTuqtNbWzn7jWnduX1F/NbidEMmCiVjOkrvaXbgBOBUmwsJUlhLVNDvEdlI55egZ8V6AK+ea3oPVa+1+6xnorhyEM1OhpWajA/3SedZQua38YVK/jL4xs4nP/4HKXuYuD1XXNNBw9/eRPS1RGaL40gJdlxGKSRLlTWF83e0bC/1ezNR+rYHSdGD2FVqonPbpK2nNycMY9SXDpCIpiDekz4VwU59L38/34Ov8jBk3qvBo3WSrQtBM0YC9jkhsK5d/vKi1MFX7zcaxijWdxgkmaVjVCRdt8Lx8kCLIKIaSuxjIh+DzrGSo+CYtFiKU7j18/4OSQWR7QFrnH9TYsnYPLRYD3kqp2GloFDeLqe669ovAlwA4Q8hKOKNLsaVXFGpOhKqwmxxMUUAVgbixFM6tcjtEWmdyY6HwMsPBple1GVI/LYISo=","self_signed":true},"subject":{"country":["AU"],"province":["Some-State"],"organization":["Internet Widgits Pty Ltd"]},"serial_number":"617747481304547497522122752841426590323176705745","version":3,"issuer":{"country":["AU"],"province":["Some-State"],"organization":["Internet Widgits Pty Ltd"]},"fingerprint_sha256":"22c751569a296b1a7f371a763cae6159f9231ba34ed6479a5e8b58c634b3321c","tbs_noct_fingerprint":"5ffc73be8aab8d893c6930b1400b89f100a7479015180531b9413a99ce45cedb","extensions":{"subject_key_id":"4d8d3fa87c0dffd3a576e45af33fa722f3c4ac98","authority_key_id":"4d8d3fa87c0dffd3a576e45af33fa722f3c4ac98","basic_constraints":{"is_ca":true}},"tbs_fingerprint":"5ffc73be8aab8d893c6930b1400b89f100a7479015180531b9413a99ce45cedb","subject_dn":"C=AU, ST=Some-State, O=Internet Widgits Pty Ltd","fingerprint_sha1":"c798e998654e5a23893563847fbb3ca079210955","spki_subject_fingerprint":"c78d715f40c8c1f9c6cbea8cd0fbd6bfbb2729052a009f50cf7611ac71b283cc","validity":{"start":"2026-08-13T09:43:21Z","length":31536000,"end":"2027-08-13T09:43:21Z"},"validation_level":"unknown"},"uri":"https://212.111.43.4:8443/","host_type":"ip","prot7":"http","target":{"ip":"212.111.43.4","type":"ip"},"geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","prot4":"tcp","protocol":"https","@timestamp":"2026-08-20T02:16:11.059Z","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"],"match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"],"match_product":"AngularJS"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"],"match_product":"Debian"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"],"match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"],"match_product":"Nginx"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"],"match_product":"Nginx"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"],"match_product":"Ubuntu"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"],"match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"],"match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"],"match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Benasin/CVE-2022-22720"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","published":"2015-07-20T23:59:02.877","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","published":"2015-03-08T02:59:00.073","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","published":"2014-07-20T11:12:48.980","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"],"match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","published":"2014-07-20T11:12:48.887","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"],"match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","published":"2014-03-18T05:18:18.750","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","published":"2014-03-18T05:18:18.657","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"],"match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","published":"2013-06-10T17:55:01.527","confidentiality_impact":"PARTIAL","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","published":"2013-02-26T16:55:01.097","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","published":"2013-02-26T16:55:01.033","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","published":"2012-11-30T19:55:01.050","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"LOW","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","published":"2012-08-22T19:55:01.633","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"COMPLETE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","published":"2012-04-18T10:33:33.667","confidentiality_impact":"COMPLETE","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","published":"2012-01-28T04:05:00.797","confidentiality_impact":"PARTIAL","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"],"match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","published":"2011-11-30T04:05:58.670","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","published":"2011-11-30T04:05:58.437","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"LOW","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","published":"2011-11-08T11:55:05.850","confidentiality_impact":"NONE","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","published":"2011-11-08T11:55:05.693","confidentiality_impact":"PARTIAL","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://community.jboss.org/message/625307"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"],"match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","published":"2010-10-04T21:00:03.627","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","published":"2010-07-28T20:00:01.213","confidentiality_impact":"NONE","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","published":"2010-06-18T16:30:01.483","confidentiality_impact":"PARTIAL","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"],"match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"],"match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"],"match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"],"match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2014-08-15T14:26:31Z","end_ip":"212.111.43.255"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2025-04-28T14:29:55Z","end_ip":"212.111.43.255"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","start_ip":"212.111.40.0","name":"US-LINODE-990630","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"registry":"ripencc","number":["63949"],"country":"US","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"port":8443,"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:15:09 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","status_line":"200 OK","title":"28ZE","version":"1.1","content_length":56889},"tag":[{"name":"indy","fullname":"Indy","indy":{"version":"9.0.11"},"category":["Web servers"]},{"java":{"version":""},"name":"java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"fullname":"Java","category":["Programming languages"]},{"name":"angularjs","description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"fullname":"AngularJS","angularjs":{"version":""},"category":["JavaScript frameworks"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"openssl":{"version":"1.0.2k"},"name":"openssl","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"fullname":"OpenSSL","category":["Web server extensions"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"debian":{"version":""},"name":"debian","description":"Debian is a Linux software which is a free open-source software.","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"fullname":"Debian","category":["Operating systems"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"name":"perl","description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"nginx":{"version":""},"name":"nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","mochiweb":{"version":"1.0"},"category":["Web servers"]},{"python":{"version":"2.7.5"},"name":"python","description":"Python is an interpreted and general-purpose programming language.","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"fullname":"Python","category":["Programming languages"]},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"php","description":"PHP is a general-purpose scripting language used for web development.","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"php":{"version":"7.3.11"},"fullname":"PHP","category":["Programming languages"]},{"name":"apache_http_server","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"name":"apache_traffic_server","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"ubuntu":{"version":""},"name":"ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"fullname":"Ubuntu","category":["Operating systems"]},{"name":"erlang","description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"erlang":{"version":"otp/18"},"fullname":"Erlang","category":["Programming languages"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"red_hat":{"version":""},"name":"red_hat","description":"Red Hat is an open-source Linux operating system.","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"fullname":"Red Hat","category":["Operating systems"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"apache_tomcat":{"version":""},"name":"apache_tomcat","description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"fullname":"Apache Tomcat","category":["Web servers"]},{"name":"centos","description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"flask","description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"fullname":"Flask","category":["Web frameworks","Web servers"],"flask":{"version":"0.9.6"}},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"isp":"Akamai Connected Cloud","ip":"212.111.43.4","uri":"http://212.111.43.4:50000/","host_type":"ip","prot7":"http","target":{"ip":"212.111.43.4","type":"ip"},"geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","protocol":"http","prot4":"tcp","@timestamp":"2026-08-20T02:16:08.996Z","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"],"match_product":"Debian"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"],"match_product":"Ubuntu"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"],"match_product":"Nginx"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"],"match_product":"Nginx"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"],"match_product":"AngularJS"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"],"match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"],"match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"],"match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"],"match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"],"match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Benasin/CVE-2022-22720"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://community.jboss.org/message/625307"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"],"match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"],"match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"],"match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"],"match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2014-08-15T14:26:31Z"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2025-04-28T14:29:55Z"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"number":["63949"],"country":"US","registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"port":50000,"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","status_line":"200 OK","version":"1.1","content_length":56889},"tag":[{"debian":{"version":""},"name":"debian","description":"Debian is a Linux software which is a free open-source software.","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"fullname":"Debian","category":["Operating systems"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"ubuntu":{"version":""},"name":"ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"fullname":"Ubuntu","category":["Operating systems"]},{"openssl":{"version":"1.0.2k"},"name":"openssl","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"fullname":"OpenSSL","category":["Web server extensions"]},{"name":"jetty","fullname":"Jetty","jetty":{"version":"6.1.19"},"category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"name":"apache_http_server","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"name":"php","description":"PHP is a general-purpose scripting language used for web development.","php":{"version":"7.3.11"},"cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"fullname":"PHP","category":["Programming languages"]},{"red_hat":{"version":""},"name":"red_hat","description":"Red Hat is an open-source Linux operating system.","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"fullname":"Red Hat","category":["Operating systems"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","mochiweb":{"version":"1.0"},"category":["Web servers"]},{"nginx":{"version":""},"name":"nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"name":"angularjs","description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"fullname":"AngularJS","angularjs":{"version":""},"category":["JavaScript frameworks"]},{"name":"flask","description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"fullname":"Flask","flask":{"version":"0.9.6"},"category":["Web frameworks","Web servers"]},{"name":"centos","description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","tengine":{"version":""},"category":["Web servers"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"apache_traffic_server","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"java":{"version":""},"name":"java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"fullname":"Java","category":["Programming languages"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"apache_tomcat":{"version":""},"name":"apache_tomcat","description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"fullname":"Apache Tomcat","category":["Web servers"]},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"indy","fullname":"Indy","indy":{"version":"9.0.11"},"category":["Web servers"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"python":{"version":"2.7.5"},"name":"python","description":"Python is an interpreted and general-purpose programming language.","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"fullname":"Python","category":["Programming languages"]},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"name":"erlang","description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"erlang":{"version":"otp/18"},"fullname":"Erlang","category":["Programming languages"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"name":"perl","description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"isp":"Akamai Connected Cloud","ip":"212.111.43.4","uri":"http://212.111.43.4:10000/","host_type":"ip","prot7":"http","target":{"ip":"212.111.43.4","type":"ip"},"geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","protocol":"http","prot4":"tcp","@timestamp":"2026-08-20T02:16:08.976Z","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"],"match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"],"match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"],"match_product":"Nginx"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"],"match_product":"Nginx"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"],"match_product":"AngularJS"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"],"match_product":"Ubuntu"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"],"match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"],"match_product":"Debian"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"],"match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"],"match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"],"match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"],"match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Benasin/CVE-2022-22720"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"],"match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://community.jboss.org/message/625307"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"],"match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"],"match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"],"match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"],"match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"],"match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"],"match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2014-08-15T14:26:31Z"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2025-04-28T14:29:55Z"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"number":["63949"],"country":"US","registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"port":10000,"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","status_line":"200 OK","version":"1.1","content_length":56889},"tag":[{"name":"erlang","description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"erlang":{"version":"otp/18"},"fullname":"Erlang","category":["Programming languages"]},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","mochiweb":{"version":"1.0"},"category":["Web servers"]},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"openssl":{"version":"1.0.2k"},"name":"openssl","description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"fullname":"OpenSSL","category":["Web server extensions"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"java":{"version":""},"name":"java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"fullname":"Java","category":["Programming languages"]},{"name":"perl","description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"nginx":{"version":""},"name":"nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"name":"php","description":"PHP is a general-purpose scripting language used for web development.","php":{"version":"7.3.11"},"cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"fullname":"PHP","category":["Programming languages"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"flask","description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"fullname":"Flask","flask":{"version":"0.9.6"},"category":["Web frameworks","Web servers"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"angularjs","description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"fullname":"AngularJS","angularjs":{"version":""},"category":["JavaScript frameworks"]},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"python":{"version":"2.7.5"},"name":"python","description":"Python is an interpreted and general-purpose programming language.","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"fullname":"Python","category":["Programming languages"]},{"red_hat":{"version":""},"name":"red_hat","description":"Red Hat is an open-source Linux operating system.","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"fullname":"Red Hat","category":["Operating systems"]},{"ubuntu":{"version":""},"name":"ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"fullname":"Ubuntu","category":["Operating systems"]},{"name":"jetty","fullname":"Jetty","jetty":{"version":"6.1.19"},"category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"apache_traffic_server","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","tengine":{"version":""},"category":["Web servers"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"centos","description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"debian":{"version":""},"name":"debian","description":"Debian is a Linux software which is a free open-source software.","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"fullname":"Debian","category":["Operating systems"]},{"name":"apache_http_server","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"indy","fullname":"Indy","indy":{"version":"9.0.11"},"category":["Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"apache_tomcat":{"version":""},"name":"apache_tomcat","description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"fullname":"Apache Tomcat","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"ip":"212.111.43.4","isp":"Akamai Connected Cloud","uri":"http://212.111.43.4:9000/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","prot4":"tcp","protocol":"http","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:08.849Z","port":9000,"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2014-08-15T14:26:31Z","end_ip":"212.111.43.255"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2025-04-28T14:29:55Z","end_ip":"212.111.43.255"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"country":"US","number":["63949"],"registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"status_line":"200 OK","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","version":"1.1","content_length":56889},"tag":[{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","category":["Web frameworks","Web servers"],"flask":{"version":"0.9.6"}},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","category":["Web servers"],"mochiweb":{"version":"1.0"}},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"php":{"version":"7.3.11"},"description":"PHP is a general-purpose scripting language used for web development.","fullname":"PHP","category":["Programming languages"]},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"name":"indy","indy":{"version":"9.0.11"},"fullname":"Indy","category":["Web servers"]},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"ip":"212.111.43.4","isp":"Akamai Connected Cloud","uri":"http://212.111.43.4:7001/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","prot4":"tcp","protocol":"http","cve":[{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:08.718Z","port":7001,"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2014-08-15T14:26:31Z","end_ip":"212.111.43.255"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2025-04-28T14:29:55Z","end_ip":"212.111.43.255"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"country":"US","number":["63949"],"registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"status_line":"200 OK","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","version":"1.1","content_length":56889},"tag":[{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"name":"indy","indy":{"version":"9.0.11"},"fullname":"Indy","category":["Web servers"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","category":["Web frameworks","Web servers"],"flask":{"version":"0.9.6"}},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"php":{"version":"7.3.11"},"description":"PHP is a general-purpose scripting language used for web development.","fullname":"PHP","category":["Programming languages"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","category":["Web servers"],"mochiweb":{"version":"1.0"}},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"ip":"212.111.43.4","isp":"Akamai Connected Cloud","uri":"http://212.111.43.4:80/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","prot4":"tcp","protocol":"http","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:08.696Z","port":80,"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2014-08-15T14:26:31Z","end_ip":"212.111.43.255"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2025-04-28T14:29:55Z","end_ip":"212.111.43.255"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"country":"US","number":["63949"],"registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"status_line":"200 OK","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","version":"1.1","content_length":56889},"tag":[{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"name":"indy","indy":{"version":"9.0.11"},"fullname":"Indy","category":["Web servers"]},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","category":["Web servers"],"mochiweb":{"version":"1.0"}},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"php":{"version":"7.3.11"},"description":"PHP is a general-purpose scripting language used for web development.","fullname":"PHP","category":["Programming languages"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","category":["Web frameworks","Web servers"],"flask":{"version":"0.9.6"}},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"ip":"212.111.43.4","isp":"Akamai Connected Cloud","uri":"http://212.111.43.4:8080/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","prot4":"tcp","protocol":"http","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:08.692Z","port":8080,"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2014-08-15T14:26:31Z","end_ip":"212.111.43.255"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2025-04-28T14:29:55Z","end_ip":"212.111.43.255"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"country":"US","number":["63949"],"registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"status_line":"200 OK","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","version":"1.1","content_length":56889},"tag":[{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","category":["Web servers"],"mochiweb":{"version":"1.0"}},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"php":{"version":"7.3.11"},"description":"PHP is a general-purpose scripting language used for web development.","fullname":"PHP","category":["Programming languages"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"name":"indy","indy":{"version":"9.0.11"},"fullname":"Indy","category":["Web servers"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","category":["Web frameworks","Web servers"],"flask":{"version":"0.9.6"}},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"ip":"212.111.43.4","isp":"Akamai Connected Cloud","uri":"http://212.111.43.4:8081/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","prot4":"tcp","protocol":"http","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"NONE","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"COMPLETE","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"LOW","availability_impact":"PARTIAL","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"PARTIAL","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","availability_impact":"NONE","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:08.683Z","port":8081,"whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","description":"Linode","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2014-08-15T14:26:31Z","end_ip":"212.111.43.255"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","description":"Akamai Technologies","range":"212.111.40.0 - 212.111.43.255","net_size":1023,"cidr":["212.111.40.0/22"],"updated":"2025-04-28T14:29:55Z","end_ip":"212.111.43.255"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"updated":"2022-12-07T14:29:12Z","end_ip":"212.111.43.255","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"country":"US","number":["63949"],"registry":"ripencc","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"status_line":"200 OK","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","title":"28ZE","version":"1.1","content_length":56889},"tag":[{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"indy","indy":{"version":"9.0.11"},"fullname":"Indy","category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","category":["Operating systems"],"windows_ce":{"version":""}},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","category":["Web frameworks","Web servers"],"flask":{"version":"0.9.6"}},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"php":{"version":"7.3.11"},"description":"PHP is a general-purpose scripting language used for web development.","fullname":"PHP","category":["Programming languages"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","fullname":"Perl","perl":{"version":""},"category":["Programming languages"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","category":["Web servers"],"mochiweb":{"version":"1.0"}},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","samsung_dvr":{"version":""},"fullname":"Web Viewer for Samsung DVR","category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack"},"data":{"ip":"212.111.43.4","isp":"Akamai Connected Cloud","uri":"http://212.111.43.4:8888/","host_type":"ip","target":{"ip":"212.111.43.4","type":"ip"},"prot7":"http","geo":{"continent":"Europe","country":"GB","city":"London","tz":"Europe/London","accuracy":20,"location":{"lon":-0.093,"lat":51.5088},"postal":"EC4R","registered_country":"US","subdivisions":["England"]},"path":"/","protocol":"http","prot4":"tcp","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item\"s size times its repeat count to a running total with no overflow check, so a large ...","published":"2026-07-13T17:17:55.670","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-57432","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between ...","published":"2026-07-13T17:16:48.923","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-13221","match_type":"product","confidentiality_impact":"NONE","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than ...","published":"2026-05-26T00:16:57.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8376","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable ...","published":"2026-03-29T21:16:15.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4176","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.4","integrity_impact":"HIGH","description":"A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, ...","published":"2025-04-13T14:15:14.527","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-56406","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find ...","published":"2024-01-02T06:15:13.737","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47039","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","published":"2023-12-18T14:15:08.933","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-47038","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.","published":"2023-08-22T19:16:31.153","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48522","match_type":"product","confidentiality_impact":"HIGH","match_product":"Perl","exploit_links":["https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; ...","published":"2026-07-21T22:19:09.667","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-62574","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, ...","published":"2026-07-21T22:17:12.190","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47063","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple ...","published":"2026-07-21T22:17:11.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-47058","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols ...","published":"2026-07-21T22:17:11.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47057","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, ...","published":"2026-04-21T21:16:32.643","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-34282","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, ...","published":"2026-04-21T21:16:28.470","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-22016","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java","exploit_links":["https://github.com/George0Papasotiriou/CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:57.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-21945","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, ...","published":"2026-01-20T22:15:55.793","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-21932","match_type":"product","confidentiality_impact":"NONE","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle ...","published":"2025-10-21T20:20:47.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-53066","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; ...","published":"2025-07-15T20:15:47.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-50106","match_type":"product","confidentiality_impact":"HIGH","match_product":"Java"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an ...","published":"2026-05-28T19:16:42.073","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.","published":"2026-05-28T19:16:41.757","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-47331","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place ...","published":"2026-04-22T09:16:21.270","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-31431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["http://www.openwall.com/lists/oss-security/2026/04/29/23","http://www.openwall.com/lists/oss-security/2026/04/29/26","http://www.openwall.com/lists/oss-security/2026/04/30/18","http://www.openwall.com/lists/oss-security/2026/04/30/5","https://copy.fail","https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170","https://github.com/theori-io/copy-fail-CVE-2026-31431","https://xint.io/blog/copy-fail-linux-distributions#the-fix-6","https://github.com/John-Popovici/CVE-2026-31431-CopyFail-Linux-PrivEsc","https://github.com/tgies/copy-fail-c","https://github.com/ZephrFish/CopyFail-CVE-2026-31431","https://github.com/insomnisec/Detections-CVE-2026-31431","https://github.com/ryan2929/CVE-2026-31431","https://github.com/st4rburn/RootRemover","https://github.com/adampielak/CVE-2026-31431_SCA_WAZUH","https://github.com/JuanBindez/CVE-2026-31431","https://github.com/selectel/mks-copy-fail-mitigation","https://github.com/deckhouse/d8-copy-fail-mitigation","https://github.com/HulnotHutu/CVE-2026-31431","https://github.com/K3ysTr0K3R/CVE-2026-31431-EXPLOIT","https://github.com/bootsareme/copyfail-deconstructed","https://github.com/monobrau/copyfailscan","https://github.com/suominen/CVE-2026-31431","https://github.com/sandraschi/copy-fail-mcp","https://github.com/juliosuas/copyfail-guard","https://github.com/samanzamani/copy-fail-checker","https://github.com/ochebotar/copy-fail-CVE-2026-31431-detection-probe","https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284","https://github.com/Liverwortenuresis371/copyfail-rs","https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail","https://github.com/infiniroot/ansible-mitigate-copyfail-dirtyfrag","https://github.com/KaraZajac/DIRTYFAIL","https://github.com/krisiasty/vcheck","https://github.com/Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe","https://github.com/Helios973/CVE-2026-31431_exp.c","https://github.com/vorkampfer/copyfail2_electric_boogaloo_fix","https://github.com/Lutfifakee-Project/CVE-2026-31431","https://github.com/mauricioportela/CVE-2026-31431-Analysis","https://github.com/gbonacini/CVE-2026-31431","https://github.com/sh4den/CVE-2026-31431-copyfail-aarch64","https://github.com/kuniyal08/Copy-Fail-CVE-2026-31431-Lab","https://github.com/SilverRuler/copy-fail-CVE-2026-31431","https://github.com/Sebastian294/cve-2026-31431","https://github.com/0xFuffM3/CVE-2026-31431-CopyFail","https://github.com/dotPY-hax/CopyFail","https://github.com/zKaaanon/ProyectoFinalSO","https://github.com/adityasingh108/CVE-2026-31431-Metasploit-exploit","https://github.com/Maxime288/CVE-2026-31431-Copy-Fail-R-pertoire-de-Pr-vention","https://github.com/Pithase/asm-copyfail","https://github.com/4xura/CVE-2026-31431-Copy-Fail","https://github.com/royayub/CVE-2026-31431","https://github.com/Yakovyakov/cve-2026-31431-mitigation","https://github.com/cj667113/OCI-Ansible-Fix-CVE-2026-31431","https://github.com/GubiczaP/cve-2026-31431-checker","https://github.com/sgkdev/ptrace_may_dream","https://github.com/yangh-beep/CVE-2026-31431-C","https://github.com/JimmyPughtron/CVE-2026-31431-Copy-Fail---Minified-LPE-PoC","https://github.com/4n4s4zi/copyfail-alpine","https://github.com/1m1ssher/copy-fail-python","https://github.com/ridhinva/linux-kernel-algif-aead-checker","https://github.com/Iamliuxiaozhen/copy_fail","https://github.com/songzzzz/CVE-2026-31431","https://github.com/vishvacyber/Detection-Tool-Kit-for-CVE-2026-31431","https://github.com/nonameuserosint-hue/Copyfail-sh","https://github.com/tematemaru/CVE-2026-31431-simple-test","https://github.com/1neptune/CopyFail","https://github.com/zs1n/copy-fail-CVE-2026-31431","https://github.com/t1ckprivate/CVE-2026-31431-Copy-Fail","https://github.com/kinryulabs/rootpacket-cve-2026-31431","https://github.com/SugiB3o/CVE-2026-31431","https://github.com/TeamN4C/SG-2026-0013","https://github.com/TrevoCastles/CVE-2026-31431-copy-fail","https://github.com/dev1681/CVE-2026-31431","https://github.com/joaocalciolari07/copyfail-guard"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\"s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, ...","published":"2026-03-17T14:16:17.410","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-3888","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://github.com/DanielTangnes/CVE-2026-3888"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","published":"2025-06-30T21:15:30.257","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-32463","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot","https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","https://github.com/4f-kira/CVE-2025-32463","https://github.com/K1tt3h/CVE-2025-32463-POC","https://github.com/IC3-512/linux-root-kit","https://github.com/7r00t/cve-2025-32463-lab","https://github.com/SysMancer/CVE-2025-32463","https://github.com/kh4sh3i/CVE-2025-32463","https://github.com/neko205-mx/CVE-2025-32463_Exploit","https://github.com/pevinkumar10/CVE-2025-32463","https://github.com/zhaduchanhzz/CVE-2025-32463_POC","https://github.com/robbert1978/CVE-2025-32463_POC","https://github.com/Mikivirus0/sudoinjection","https://github.com/san8383/CVE-2025-32463","https://github.com/0xAkarii/CVE-2025-32463","https://github.com/CIA911/sudo_patch_CVE-2025-32463","https://github.com/mirchr/CVE-2025-32463-sudo-chwoot","https://github.com/ill-deed/CVE-2025-32463_illdeed","https://github.com/zinzloun/CVE-2025-32463","https://github.com/0p5cur/CVE-2025-32463-POC","https://github.com/gmh5225/Blackash-CVE-2025-32463","https://github.com/FreeDurok/CVE-2025-32463-PoC","https://github.com/Chocapikk/CVE-2025-32463-lab","https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT","https://github.com/SpongeBob-369/cve-2025-32463","https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot","https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC","https://github.com/morgenm/sudo-chroot-CVE-2025-32463","https://github.com/MohamedKarrab/CVE-2025-32463","https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC","https://github.com/Rajneeshkarya/CVE-2025-32463","https://github.com/MGunturG/CVE-2025-32463","https://github.com/Maalfer/Sudo-CVE-2021-3156","https://github.com/daryllundy/CVE-2025-32463","https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462","https://github.com/ChetanKomal/sudo_exploit","https://github.com/KaiHT-Ladiant/CVE-2025-32463","https://github.com/y4ney/CVE-2025-32463-lab","https://github.com/aldoClau98/CVE-2025-32463","https://github.com/painoob/CVE-2025-32463","https://github.com/1xPwn/CVE-2025-32463","https://github.com/Yuy0ung/CVE-2025-32463_chwoot","https://github.com/blackcat4347/CVE-2025-32463_PoC","https://github.com/ashardev002/CVE-2025-32463_chwoot","https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape","https://github.com/AC8999/CVE-2025-32463","https://github.com/secvulnhub/CVE-2025-32463-EXPLOIT","https://github.com/dr4xp/sudo-chroot","https://github.com/NewComrade12211/CVE-2025-32463","https://github.com/Ghstxz/CVE-2025-32463","https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation","https://github.com/justjoeyking/CVE-2025-32463","https://github.com/Mr-Alperen/CVE-2025-32463","https://github.com/SpycioKon/CVE-2025-32463","https://github.com/vpr-labs/CVE-2025-32463","https://github.com/danilo1992-sys/CVE-2025-32463","https://github.com/0xBlackash/CVE-2025-32463","https://github.com/Fomovet/cve-2025-32463","https://github.com/0xdak/CVE-2025-32463_exploit"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Ubuntu\"s configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.","published":"2025-01-31T02:15:28.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-1736","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"A security regression (CVE-2006-5051) was discovered in OpenSSH\"s server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to ...","published":"2024-07-01T13:15:06.467","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6387","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","http://www.openwall.com/lists/oss-security/2024/07/03/11","http://www.openwall.com/lists/oss-security/2024/07/04/2","http://www.openwall.com/lists/oss-security/2024/07/08/2","http://www.openwall.com/lists/oss-security/2024/07/09/5","http://www.openwall.com/lists/oss-security/2024/07/10/1","https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","https://www.exploit-db.com/exploits/52269","https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","https://github.com/7etsuo/cve-2024-6387-poc","https://github.com/zgzhang/cve-2024-6387-poc","https://github.com/acrono/cve-2024-6387-poc","https://github.com/lflare/cve-2024-6387-poc","https://github.com/getdrive/CVE-2024-6387-PoC","https://github.com/FerasAlrimali/CVE-2024-6387-POC","https://github.com/passwa11/cve-2024-6387-poc","https://github.com/jack0we/CVE-2024-6387","https://github.com/xaitax/CVE-2024-6387_Check","https://github.com/bigb0x/CVE-2024-6387","https://github.com/wiggels/regresshion-check","https://github.com/P4x1s/CVE-2024-6387","https://github.com/betancour/OpenSSH-Vulnerability-test","https://github.com/muyuanlove/CVE-2024-6387fixshell","https://github.com/TAM-K592/CVE-2024-6387","https://github.com/teamos-hub/regreSSHion","https://github.com/ahlfors/CVE-2024-6387","https://github.com/Mufti22/CVE-2024-6387-checkher","https://github.com/thegenetic/CVE-2024-6387-exploit","https://github.com/R4Tw1z/CVE-2024-6387","https://github.com/d0rb/CVE-2024-6387","https://github.com/CiderAndWhisky/regression-scanner","https://github.com/shamo0/CVE-2024-6387_PoC","https://github.com/paradessia/CVE-2024-6387-nmap","https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit","https://github.com/daniel-odrinski/CVE-2024-6387-Mitigation-Ansible-Playbook","https://github.com/rumochnaya/openssh-cve-2024-6387.sh","https://github.com/zenzue/CVE-2024-6387-Mitigation","https://github.com/devarshishimpi/CVE-2024-6387-Check","https://github.com/hssmo/cve-2024-6387_AImade","https://github.com/ACHUX21/checker-CVE-2024-6387","https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387","https://github.com/xristos8574/regreSSHion-nmap-scanner","https://github.com/particle99/CVE-2024-6387-POC","https://github.com/xonoxitron/regreSSHion","https://github.com/no-one-sec/CVE-2024-6387","https://github.com/dawnl3ss/CVE-2024-6387","https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC","https://github.com/th3gokul/CVE-2024-6387","https://github.com/n1cks0n/Test_CVE-2024-6387","https://github.com/l0n3m4n/CVE-2024-6387","https://github.com/RickGeex/CVE-2024-6387-Checker","https://github.com/xonoxitron/regreSSHion-checker","https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template","https://github.com/edsonjt81/CVE-2024-6387_Check","https://github.com/grupooruss/CVE-2024-6387","https://github.com/CognisysGroup/CVE-2024-6387-Checker","https://github.com/sxlmnwb/CVE-2024-6387","https://github.com/Symbolexe/CVE-2024-6387","https://github.com/harshinsecurity/sentinelssh","https://github.com/t3rry327/cve-2024-6387-poc","https://github.com/jocker2410/CVE-2024-6387_poc","https://github.com/JackSparrowhk/ssh-CVE-2024-6387-poc","https://github.com/turbobit/CVE-2024-6387-OpenSSH-Vulnerability-Checker","https://github.com/sms2056/CVE-2024-6387","https://github.com/invaderslabs/regreSSHion-CVE-2024-6387-","https://github.com/lala-amber/CVE-2024-6387","https://github.com/4lxprime/regreSSHive","https://github.com/sardine-web/CVE-2024-6387_Check","https://github.com/0x4D31/cve-2024-6387_hassh","https://github.com/sardine-web/CVE-2024-6387-template","https://github.com/imv7/CVE-2024-6387","https://github.com/azurejoga/CVE-2024-6387-how-to-fix","https://github.com/Karmakstylez/CVE-2024-6387","https://github.com/vkaushik-chef/regreSSHion","https://github.com/dgourillon/mitigate-CVE-2024-6387","https://github.com/mrmtwoj/CVE-2024-6387","https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker","https://github.com/kubota/CVE-2024-6387-Vulnerability-Checker","https://github.com/DimaMend/cve-2024-6387-poc","https://github.com/redux-sibi-jose/mitigate_ssh","https://github.com/dream434/CVE-2024-6387","https://github.com/Ap0dexMe0/CVE-2024-6387","https://github.com/prelearn-code/CVE-2024-6387","https://github.com/l-urk/CVE-2024-6387","https://github.com/alex14324/ssh_poc2024","https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker","https://github.com/s1d6point7bugcrowd/CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH","https://github.com/almogopp/OpenSSH-CVE-2024-6387-Fix","https://github.com/HadesNull123/CVE-2024-6387_Check","https://github.com/identity-threat-labs/CVE-2024-6387-Vulnerability-Checker","https://github.com/identity-threat-labs/Article-RegreSSHion-CVE-2024-6387","https://github.com/anhvutuan/CVE-2024-6387-poc-1","https://github.com/YassDEV221608/CVE-2024-6387","https://github.com/awusan125/test_for6387","https://github.com/kinu404/CVE-2024-6387","https://github.com/xiw1ll/CVE-2024-6387_Checker","https://github.com/moften/regreSSHion-CVE-2024-6387","https://github.com/OHHDamnBRO/Noregressh","https://github.com/Ngagne-Demba-Dia/CVE-2024-6387-corrigee","https://github.com/Doux-x/CVE-2024-6387-analysis","https://github.com/kaleth4/CVE-2024-6387","https://github.com/oseasfr/Scanner_CVE_OpenSSH","https://github.com/vuducmanhno100-cloud/CVE-2024-6387","https://github.com/m0n3ef/regreSSHion-Checker","https://github.com/al7araziruby-jpg/CVE-2024-6387-OpenSSH-Analysis","https://github.com/hasan8babiker/CVE-2024-6387"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","has_exploit":true,"description":"When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main ...","published":"2024-06-21T20:15:10.630","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27352","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu","exploit_links":["https://bugs.launchpad.net/snapd/+bug/1910456","https://bugs.launchpad.net/snapd/+bug/1910456"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Apport does not disable python crash handler before entering chroot","published":"2024-06-04T22:15:10.087","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28657","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ubuntu"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","description":"is_closing_session() allows users to create arbitrary tcp dbus connections","published":"2024-06-04T22:15:09.940","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28655","match_type":"product","confidentiality_impact":"NONE","match_product":"Ubuntu"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.","published":"2023-11-28T12:15:07.040","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5981","match_type":"product","confidentiality_impact":"HIGH","match_product":"Red Hat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server\"s mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.","published":"2026-06-08T16:16:44.223","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-49975","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian","exploit_links":["https://github.com/fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-","https://github.com/mrx-arafat/CVE-2026-49975-POC","https://github.com/obrige/http2-bomb","https://github.com/renzi25031469/CVE-2026-49975-HTTP-2-Bomb","https://github.com/EQSTLab/CVE-2026-49975","https://github.com/LSG-PolarBear/CVE-2026-49975","https://github.com/LiaoZiqi-GZFLS/CVE-2026-49975","https://github.com/minc-nice-100/http2-bomb-analysis-paper","https://github.com/razureink/cve-2026-49975-http2bomb_reproduction","https://github.com/0xc03307b/CVE-2026-49975","https://github.com/wlor0623/http2-bomb-detector"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for ...","published":"2026-05-22T15:16:27.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9256","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/suominen/CVE-2026-9256","https://github.com/W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256","https://github.com/3nou9h/CVE-2026-9256-Poc","https://github.com/06-ux/CVE-2026-9256-POC"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.1","integrity_impact":"HIGH","has_exploit":true,"description":"In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner \"get_dumpable()\" logic The \"dumpability\" of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - ...","published":"2026-05-15T14:16:35.793","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-46333","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://github.com/KaraZajac/CHARON","https://github.com/st4rburn/public-passwd","https://github.com/0xBlackash/CVE-2026-46333","https://github.com/studiogangster/CVE-2026-46333"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","published":"2026-04-16T18:16:45.980","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-41082","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due ...","published":"2026-03-24T15:16:39.693","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2026-4775","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset ...","published":"2026-03-23T22:16:25.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1940","match_type":"product","confidentiality_impact":"NONE","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","has_exploit":true,"description":"AWStats 8.0 is vulnerable to Command Injection via the open function","published":"2026-03-20T21:17:12.800","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-63261","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian","exploit_links":["https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process ...","published":"2026-02-10T19:16:03.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25506","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.2","integrity_impact":"HIGH","description":"Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un ...","published":"2026-02-03T20:15:56.983","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-62799","match_type":"product","confidentiality_impact":"HIGH","match_product":"Debian"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","match_product":"AngularJS","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:52.720","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60530","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the ...","published":"2026-07-21T22:17:47.857","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60454","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:46.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60438","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.6","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access ...","published":"2026-07-21T22:17:45.617","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60431","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability ...","published":"2026-07-21T22:17:39.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60365","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable ...","published":"2026-07-21T22:17:39.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60364","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ...","published":"2026-07-21T22:17:39.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-60363","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.7","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access ...","published":"2026-04-21T21:16:33.950","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34291","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"10.0","integrity_impact":"HIGH","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are ...","published":"2026-01-20T22:15:59.110","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-21962","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...","published":"2023-10-17T22:15:11.747","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-22019","match_type":"product","confidentiality_impact":"HIGH","match_product":"Oracle HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat\"s WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the ...","published":"2026-07-28T15:17:50.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-66299","match_type":"product","confidentiality_impact":"NONE","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 ...","published":"2026-07-14T09:16:41.607","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59084","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\"s rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through ...","published":"2026-07-14T09:16:41.483","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-59083","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from ...","published":"2026-06-29T21:16:45.700","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-55957","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat","exploit_links":["https://github.com/mdvpat/CVE-2026-55957-PoC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:45.380","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-55276","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. ...","published":"2026-06-29T21:16:44.937","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-53434","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\"s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through ...","published":"2026-06-29T21:16:44.527","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-53404","match_type":"product","confidentiality_impact":"LOW","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through ...","published":"2026-05-12T16:16:18.553","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43515","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43515-poc"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from ...","published":"2026-05-12T16:16:18.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-43513","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through ...","published":"2026-05-12T16:16:17.990","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-43512","match_type":"product","confidentiality_impact":"HIGH","match_product":"Apache Tomcat","exploit_links":["https://github.com/covepseng/cve-2026-43512-poc"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.","published":"2026-05-26T18:16:57.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-9170","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.","published":"2026-05-26T18:16:57.300","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8856","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).","published":"2026-05-26T18:16:57.170","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8855","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.","published":"2026-05-26T18:16:57.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8854","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.","published":"2026-05-26T18:16:56.803","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8835","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service.","published":"2026-05-26T18:16:56.667","attack_vector":"ADJACENT_NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8834","match_type":"product","confidentiality_impact":"HIGH","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.","published":"2026-05-26T17:16:55.770","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8852","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.","published":"2026-05-26T17:16:55.640","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-8850","match_type":"product","confidentiality_impact":"NONE","match_product":"IBM HTTP Server"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","published":"2023-10-10T14:15:10.883","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-44487","match_type":"product","confidentiality_impact":"NONE","match_product":"Nginx","exploit_links":["https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/micrictor/http2-rst-stream","https://security.netapp.com/advisory/ntap-20240621-0006/","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/imabee101/CVE-2023-44487","https://github.com/ByteHackr/CVE-2023-44487","https://github.com/pabloec20/rapidreset","https://github.com/secengjeff/rapidresetclient","https://github.com/studiogangster/CVE-2023-44487","https://github.com/ReToCode/golang-CVE-2023-44487","https://github.com/ndrscodes/http2-rst-stream-attacker","https://github.com/nxenon/cve-2023-44487","https://github.com/sigridou/CVE-2023-44487-","https://github.com/TYuan0816/cve-2023-44487","https://github.com/sn130hk/CVE-2023-44487","https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC","https://github.com/aulauniversal/CVE-2023-44487","https://github.com/BMG-Black-Magic/CVE-2023-44487","https://github.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack","https://github.com/zanks08/cve-2023-44487-demo","https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset","https://github.com/tpirate/cve-2023-44487-POC","https://github.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos","https://github.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-","https://github.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab","https://github.com/Hirokiii/CVE-2023-44487","https://github.com/madhantr0/http2-security-lab","https://github.com/tahaXafous/CVE-2023-44487-dos","https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets ...","published":"2025-02-05T18:15:33.347","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-23419","match_type":"product","confidentiality_impact":"LOW","match_product":"Nginx","exploit_links":["https://github.com/harley-ghostie/safe-check-CVE-2025-23419","https://github.com/xitexploiter96-dot/CVE-2025-23419"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which ...","published":"2026-06-08T16:16:39.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-42535","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled ...","published":"2026-05-05T22:16:00.390","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-28780","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for ...","published":"2026-05-04T15:16:03.720","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-29169","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T13:16:00.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34059","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T13:16:00.297","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-24072","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.3","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...","published":"2025-12-05T14:15:49.153","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2025-58098","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dhmosfunk/CVE-2025-58098"]},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.4","integrity_impact":"HIGH","description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable ...","published":"2025-07-10T17:15:48.193","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-49812","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.","published":"2024-07-18T10:15:03.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2024-40898","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/anilpatel199n/CVE-2024-40898","https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"LOW","has_exploit":true,"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.","published":"2024-04-04T20:15:08.047","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-38709","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15","exploit_links":["https://github.com/mrmtwoj/apache-vulnerability-testing"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","published":"2023-10-23T07:15:11.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2023-31122","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.","published":"2023-01-17T20:15:11.177","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2006-20001","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/r1az4r/CVE-2006-20001"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","published":"2022-06-09T17:15:09.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-31813","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/dodiorne/cve-2022-31813","https://github.com/yiliufeng168/CVE-2022-31813"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","published":"2022-06-09T17:15:09.867","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-30556","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","published":"2022-06-09T17:15:09.283","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-29404","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, ...","published":"2022-06-09T17:15:09.230","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-28615","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22721","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","published":"2022-03-14T11:15:09.083","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22720","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/Benasin/CVE-2022-22720"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","published":"2022-03-14T11:15:09.023","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-22719","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This ...","published":"2021-12-20T12:15:07.440","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-44790","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","https://github.com/nuPacaChi/-CVE-2021-44790","https://github.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790"]},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.0","integrity_impact":"HIGH","has_exploit":true,"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.633","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-40438","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/xiaojiangxl/CVE-2021-40438","https://github.com/sixpacksecurity/CVE-2021-40438","https://github.com/BabyTeam1024/CVE-2021-40438","https://github.com/ericmann/apache-cve-poc","https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt","https://github.com/gassara-kys/CVE-2021-40438","https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit","https://github.com/Cappricio-Securities/CVE-2021-40438","https://github.com/yakir2b/check-point-gateways-rce","https://github.com/n0m-d/CVE-2021-40438-POC"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.580","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-39275","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","published":"2021-09-16T15:15:07.267","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2021-34798","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of ...","published":"2018-03-26T15:29:00.523","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1303","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\"s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through ...","published":"2017-09-18T15:29:00.307","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9798","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","https://github.com/hannob/optionsbleed","https://github.com/nitrado/CVE-2017-9798","https://github.com/pabloec20/optionsbleed","https://github.com/l0n3rs/CVE-2017-9798","https://github.com/brokensound77/OptionsBleed-POC-Scanner"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in ...","published":"2017-07-27T21:29:00.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2016-8743","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"NONE","description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type \"Digest\" was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key ...","published":"2017-07-13T16:29:00.227","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-9788","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","published":"2017-06-20T01:29:00.423","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7679","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15","exploit_links":["https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679","https://github.com/snknritr/CVE-2017-7679-in-python","https://github.com/Al-Lord0x/CVE-2017-7679"]},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","published":"2017-06-20T01:29:00.360","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3169","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","published":"2017-06-20T01:29:00.330","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-3167","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ...","published":"2016-07-19T02:00:19.837","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2016-5387","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Apache 2.2.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.8","integrity_impact":"NONE","has_exploit":true,"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as ...","published":"2011-08-29T15:55:02.017","attack_vector":"NETWORK","availability_impact":"COMPLETE","name":"CVE-2011-3192","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["https://github.com/tkisason/KillApachePy","https://github.com/stcmjp/cve-2011-3192","https://github.com/futurezayka/CVE-2011-3192","https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"A cross-site scripting vulnerability exists in mod_proxy_ftp\"s HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to ...","published":"2026-06-08T16:16:38.093","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2026-29170","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"4.8","integrity_impact":"LOW","description":"A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.","published":"2026-05-04T15:16:03.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33006","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.447","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-34032","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.","published":"2026-05-04T14:16:33.253","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33857","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be ...","published":"2023-01-17T20:15:11.670","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-37436","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and ...","published":"2022-06-09T17:15:09.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28614","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","published":"2022-06-09T17:15:09.133","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-28330","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. ...","published":"2018-08-14T12:29:00.220","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2016-4975","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to ...","published":"2018-03-26T15:29:00.477","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1302","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to ...","published":"2018-03-26T15:29:00.430","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-1301","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","description":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","published":"2018-03-09T20:29:00.410","attack_vector":"ADJACENT_NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2016-8612","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","name":"CVE-2015-3183","match_type":"cpe","description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large ...","confidentiality_impact":"NONE","published":"2015-07-20T23:59:02.877","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2015-0228","match_type":"cpe","description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has ...","confidentiality_impact":"NONE","published":"2015-03-08T02:59:00.073","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0231","match_type":"cpe","description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.980","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.8","integrity_impact":"PARTIAL","has_exploit":true,"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a ...","published":"2014-07-20T11:12:48.933","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2014-0226","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://seclists.org/fulldisclosure/2014/Jul/114","https://github.com/shreesh1/CVE-2014-0226-poc"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2014-0118","match_type":"cpe","description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted ...","confidentiality_impact":"NONE","published":"2014-07-20T11:12:48.887","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"PARTIAL","has_exploit":true,"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a ...","published":"2014-04-15T10:55:11.150","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2013-5704","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://martin.swende.se/blog/HTTPChunked.html"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2014-0098","match_type":"cpe","description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.750","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2013-6438","match_type":"cpe","description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via ...","confidentiality_impact":"NONE","published":"2014-03-18T05:18:18.657","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for ...","published":"2013-07-10T20:55:01.023","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2013-1896","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.1","integrity_impact":"PARTIAL","name":"CVE-2013-1862","match_type":"cpe","description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing ...","confidentiality_impact":"PARTIAL","published":"2013-06-10T17:55:01.527","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-4558","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.097","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2012-3499","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, ...","confidentiality_impact":"NONE","published":"2013-02-26T16:55:01.033","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2012-4557","match_type":"cpe","description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an ...","confidentiality_impact":"NONE","published":"2012-11-30T19:55:01.050","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"LOW","attack_complexity":"HIGH","base_score":"2.6","integrity_impact":"PARTIAL","name":"CVE-2012-2687","match_type":"cpe","description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to ...","confidentiality_impact":"NONE","published":"2012-08-22T19:55:01.633","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"COMPLETE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"6.9","integrity_impact":"COMPLETE","name":"CVE-2012-0883","match_type":"cpe","description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","confidentiality_impact":"COMPLETE","published":"2012-04-18T10:33:33.667","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","name":"CVE-2012-0053","match_type":"cpe","description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors ...","confidentiality_impact":"PARTIAL","published":"2012-01-28T04:05:00.797","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.6","integrity_impact":"PARTIAL","has_exploit":true,"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory ...","published":"2012-01-18T20:55:02.737","attack_vector":"LOCAL","availability_impact":"PARTIAL","name":"CVE-2012-0031","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/"]},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-4317","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.670","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","name":"CVE-2011-3639","match_type":"cpe","description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of ...","confidentiality_impact":"NONE","published":"2011-11-30T04:05:58.437","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"LOW","attack_complexity":"HIGH","base_score":"1.2","integrity_impact":"NONE","name":"CVE-2011-4415","match_type":"cpe","description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause ...","confidentiality_impact":"NONE","published":"2011-11-08T11:55:05.850","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.4","integrity_impact":"PARTIAL","name":"CVE-2011-3607","match_type":"cpe","description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted ...","confidentiality_impact":"PARTIAL","published":"2011-11-08T11:55:05.693","attack_vector":"LOCAL","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, ...","published":"2011-10-05T22:55:02.643","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2011-3368","match_type":"cpe","confidentiality_impact":"PARTIAL","match_product":"Apache 2.2.15","exploit_links":["https://github.com/SECFORCE/CVE-2011-3368","https://github.com/colorblindpentester/CVE-2011-3368"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP ...","published":"2011-09-20T05:55:02.983","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-3348","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://community.jboss.org/message/625307"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac ...","published":"2011-05-16T17:55:02.387","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2011-0419","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246","http://securityreason.com/achievement_securityalert/98","http://securityreason.com/securityalert/8246"]},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1623","match_type":"cpe","description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote ...","confidentiality_impact":"NONE","published":"2010-10-04T21:00:03.627","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"PARTIAL","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-1452","match_type":"cpe","description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","confidentiality_impact":"NONE","published":"2010-07-28T20:00:01.213","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"availability_impact":"NONE","severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","name":"CVE-2010-2068","match_type":"cpe","description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows ...","confidentiality_impact":"PARTIAL","published":"2010-06-18T16:30:01.483","attack_vector":"NETWORK","match_product":"Apache 2.2.15"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that ...","published":"2009-12-04T21:30:00.500","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3560","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.0","integrity_impact":"NONE","has_exploit":true,"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted ...","published":"2009-11-03T16:30:12.563","attack_vector":"NETWORK","availability_impact":"PARTIAL","name":"CVE-2009-3720","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch","http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch"]},{"severity":"MEDIUM","attack_complexity":"MEDIUM","base_score":"4.3","integrity_impact":"PARTIAL","has_exploit":true,"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users ...","published":"2008-01-25T01:00:00.000","attack_vector":"NETWORK","availability_impact":"NONE","name":"CVE-2008-0455","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Apache 2.2.15","exploit_links":["http://securityreason.com/securityalert/3575","http://securitytracker.com/id?1019256","http://www.mindedsecurity.com/MSA01150108.html","http://www.securityfocus.com/bid/27409"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.","published":"2019-10-11T20:15:16.860","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21028","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Boa 0.93.15"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.","published":"2019-10-11T20:15:16.783","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2018-21027","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Boa 0.93.15"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service ...","published":"2022-07-07T21:15:10.150","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-2048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"7.0","integrity_impact":"HIGH","has_exploit":true,"description":"In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system\"s temporary directory is shared between all users on that system. A collocated user can observe ...","published":"2020-10-23T13:15:16.283","attack_vector":"LOCAL","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2020-27216","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19","exploit_links":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921","https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053"]},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Dump Servlet information leak in jetty before 6.1.22.","published":"2019-11-06T20:15:09.723","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2009-5045","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a ...","published":"2018-06-26T17:29:00.210","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7658","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. ...","published":"2018-06-26T16:29:00.257","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2017-7657","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares ...","published":"2018-06-26T15:29:00.217","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-7656","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","published":"2017-06-16T21:29:00.710","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2017-9735","match_type":"cpe","confidentiality_impact":"HIGH","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty ...","published":"2023-04-18T21:15:09.043","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-26049","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause ...","published":"2023-04-18T21:15:08.977","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2023-26048","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2023-26048"]},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.7","integrity_impact":"LOW","description":"In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead ...","published":"2022-07-07T21:15:10.093","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-2047","match_type":"cpe","confidentiality_impact":"NONE","match_product":"Jetty 6.1.19"},{"severity":"LOW","attack_complexity":"LOW","base_score":"3.5","integrity_impact":"LOW","has_exploit":true,"description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and ...","published":"2021-06-22T15:15:16.443","attack_vector":"PHYSICAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-34428","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19","exploit_links":["https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"]},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` ...","published":"2021-06-09T02:15:06.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2021-28169","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","description":"JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.","published":"2019-11-06T20:15:09.803","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2009-5046","match_type":"cpe","confidentiality_impact":"LOW","match_product":"Jetty 6.1.19"}],"@timestamp":"2026-08-20T02:16:08.458Z","whois":{"abuse":"abuse@linode.com","related_nets":[{"created":"2014-08-15T14:26:31Z","start_ip":"212.111.40.0","range":"212.111.40.0 - 212.111.43.255","description":"Linode","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2014-08-15T14:26:31Z"},{"created":"2025-04-28T14:29:55Z","start_ip":"212.111.40.0","range":"212.111.40.0 - 212.111.43.255","description":"Akamai Technologies","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2025-04-28T14:29:55Z"}],"net":{"country":"GB","address":"249 Arch Street\n19106\nPhiladelphia\nUNITED STATES","created":"2014-08-14T12:10:40Z","range":"212.111.40.0 - 212.111.43.255","handle":"TA2589-RIPE","organization":"ORG-LL72-RIPE","name":"US-LINODE-990630","start_ip":"212.111.40.0","cidr":["212.111.40.0/22"],"net_size":1023,"end_ip":"212.111.43.255","updated":"2022-12-07T14:29:12Z","contacts":{"emails":["abuse@linode.com"],"persons":["Thomas Asaro"],"phones":["+16093807100","+16093807504"]}},"asn":{"number":["63949"],"registry":"ripencc","country":"US","name":"AKAMAI-LINODE-AP - Akamai Connected Cloud","cidr":"212.111.40.0/22","updated":"1999-06-30"}},"port":8888,"host":"212.111.43.4","http":{"headers":{"date":["Thu, 20 Aug 2026 02:14:58 GMT"],"server":["360 web server, 792/71644 HTTP Server version 2.0 - TELDAT S.A., A10WS/1.00, ADB Broadband HTTP Server, ADH-Web, AR, ASUSTeK UPnP/1.0 MiniUPnPd/1.4, ATS/5.3.0, Adaptec ASM 1.1, AirTies/ASP 1.0 UPnP/1.0 miniupnpd/1.0, Allegro-Software-RomPager/4.06, AmirHossein Server v1.0, AnWeb/1.42p, Android Webcam Server, AnyStor-E, Apache-Coyote/1.1, Apache/2.2.15 (CentOS), Apache/2.4.29 (Ubuntu), Apache/2.4.6 (Red Hat Enterprise Linux) PHP/7.3.11, Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.46 OpenSSL/1.0.2k-fips, App-webs/, ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.4), AvigilonGateway/1.0 Microsoft-HTTPAPI/2.0, Avtech, Baby Web Server, BigIP, BlueIris-HTTP/1.1, Boa/0.93.15, Boa/0.94.13, Boa/0.94.14rc20, Boa/0.94.14rc21, Boa/0.94.7, BolidXMLRPC/1.10 (Windows NT) ORION-BOLID v1.10, BroadWorks, Brovotech/2.0.0, CJServer/1.1, CPWS, CVM, Caddy, Cam, Cambium HTTP Server, Camera Web Server, CentOS WebPanel: Protected by Mod Security, Check Point SVN foundation, Cherokee/1.2.101 (Ubuntu), CherryPy/2.3.0, CherryPy/3.1.0beta3 WSGI Server, CherryPy/8.1.2, CirCarLife Scada v4.2.3, Cirpark Scada v4.5.3-rc1, Cisco AWARE 2.0, Citrix Web PN Server, Commvault WebServer, Control4 Web Server, CouchDB/1.6.1 (Erlang OTP/18), CouchDB/1.6.1 (Erlang OTP/R16B03), CouchDB/2.0.0 (Erlang OTP/17), Cougar/9.01.01.3841, Cougar/9.01.01.5001, Cowboy, Cross Web Server, D-Link Web Server 0.01, DNVRS-Webs, DVR-HttpServer/1.0, DVRDVS-Webs, DWS, DasanNetwork Solution, Debian/4.0 UPnP/1.0 miniupnpd/1.0, Deluxe Beauty Office, Destiny, DpmptspKarawangkab_HTTP_SERVER, E2EE Server 1.0, EBox, EShare Http Server/1.0, Easy-Web Server/1.0, Embedded HTTP Server., Embedded HTTPD v1.00, 1999(c) Delta Networks Inc., Embedthis-Appweb/3.2.3, Embedthis-Appweb/3.3.1, Embedthis-http, Entrust, Ericom Access Server, Ericom Access Server x64, FN-Httpd 1.0 [HTTP/1.1], FUJITSU ServerView iRMC S4 Webserver, FileMakerPro/6.0Fv4 WebCompanion/6.0v3, Flussonic, GSHD/3.0, GeoHttpServer, GeoWebServer 4.4.1.0, Ginatex-HTTPServer, GlassFish Server Open Source Edition 4.0, GoAhead-Webs, GoAhead-Webs/2.5.0, GoAhead-http, GoTTY, H3C-Miniware-Webs, HFS 2.2f, HFS 2.3 beta, HFS 2.3e, HFS 2.3i, HFS 2.3k, HFS 2.3m, HTTP Server, HTTP Server 1.0, HTTP Software 1.1, HTTPD, HTTPD Web Server, HTTPD-HR Server powered by Apache, HTTPD_gw 1.0, Hikvision-Webs, Hipcam, HostGW.com EnterpriseServer built fo SMKN 1 Kaligondang, Http Server, Httpd, Httpd/1.0, Hydra/0.1.8, IBM_HTTP_Server, IIS, IP Webcam Server, IPC@CHIP, IPCamera-Webs, IPCamera-Webs/2.5.0, IPCamera_Logo, IPOffice/, IceWarp/12.1.1.4 x64, IceWarp/9.4.2, IdeaWebServer/0.83.292, If you want know, you can ask me, Indy/9.0.11, Intoto Http Server v1.0, InvalidPanda/1.0.0, JAWS/1.0, JAWS/1.0 Jan 21 2017, JBoss-EAP/7, JDVR/4.0, JFinal 4.5, JWS, Jetty(6.1.19), KMS_ACCESS, Keil-EWEB/2.1, Kerio MailServer 6.5.2, Kestrel, LINUX-2.6 UPnP/1.0 MiniUPnPd/1.5, LTE Router Webs, Lanswitch - V100R003 HttpServer 1.1, Linux, HTTP/1.1, DIR-860L Ver 1.01, Linux/2.6.18 UPnP/1.0 miniupnpd/1.0, Linux/2.x UPnP/1.0 Avtech/1.0, Linux/3.10.0 eHomeMediaCenter/1.0, Linux/3.10.104 eHomeMediaCenter/1.0, Linux/3.10.33 UPnP/1.0 Teleal-Cling/1.0, Linux/3.14.29 CyberHTTP/1.0, Linux/3.4.39 UPnP/1.0 Cling/2.0, LiteSpeed, Lotus-Domino, MIPS LINUX/2.4 UPnP/1.0 miniupnpd/1.0, MJPG-Streamer/0.2, MS-SDK-HttpServer/1.0, MailEnable-HTTP/5.0, Mars, Mathopd/1.5p6, Mbedthis-AppWeb/2.0.4, Mbedthis-Appweb/12.5.0, Mbedthis-Appweb/2.4.0, Mbedthis-Appweb/2.4.2, Microsoft-HTTPAPI/1.0, Microsoft-HTTPAPI/2.0, Microsoft-IIS/10.0, Microsoft-IIS/5.0, Microsoft-IIS/5.1, Microsoft-IIS/6.0, Microsoft-IIS/7.0, Microsoft-IIS/7.5, Microsoft-IIS/8.0, Microsoft-IIS/8.5, Microsoft-NetCore/2.0, UPnP/1.0 DLNADOC/1.50, Microsoft-WinCE/7.00, Mikrotik HttpProxy, Mini Embedded Web Server, Mini web server 1., Mini web server 1.0 ZTE corp 2005., Mini web server 1.0 ZXIC corp 2005., MiniServ/1.890, MistServer/2.14.2, MochiWeb/1.0 (Any of you quaids got a smint?), MonitorServer/0.10.5.363 Python/2.7.5, Monitorix HTTP Server, Monkey, Mono-HTTPAPI/1.0, MoxaHttp/1.0, Mrvl-R1_0, Mrvl-R2_0, NISS, NVR EXT SERVER, NVR Webserver, Net-OS 5.xx UPnP/1.0, NetBox Version 2.8 Build 4128, NetEVI/3.10, Netwave IP Camera, Network Camera with Pan/Tilt, Network_Module/1.0 (WXA-50), Nexus/3.13.0-01 (OSS), Nexus/3.9.0-01 (OSS), Nginx, Nginx Microsoft-HTTPAPI/2.0, Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0, OPNsense, OceanView-CDN, Oktell LS, OpenBCM/1.07b3, OpenBSD httpd, Oracle Containers for J2EE, Oracle GlassFish Server 3.1.2.2, Oracle XML DB/Oracle Database, Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server, Oracle-Application-Server-11g, Oracle-HTTP-Server, Oracle-HTTP-Server-11g, Oracle_WebDb_Listener/2.1, PBX/63.0.2 (CentOS64), PRTG/19.3.51.2830, Pan/Tilt, PanWeb Server/ -, Payara Server 5.193 #badassfish, PrHTTPD Ver1.0, Proxy, Python/3.6 aiohttp/2.3.10, Qualvision -HTTPServer, REP Server, RNOAAA018180026 HTTP Server version 2.0 - TELDAT S.A., Rabbit, RapidLogic/1.1, Raption v5.8.0, ReeCam IP Camera, RemotelyAnywhere/9.0.856, Reposify, Resin/2.1.12, Resin/3.0.17, Resin/3.1.8, Rex/12.0.7601.17514, RomPager/4.07 UPnP/1.0, RomPager/4.51 UPnP/1.0, Router, Router Webserver, SAP, SCADA, SQ-WEBCAM, SRS/3.0.45(OuXuli), SY8033, SY8045, Safe3 Web Firewall, Safedog/4.0.0, ScreenConnect/19.4.25542.7213-2135886336 Microsoft-HTTPAPI/2.0, Serv-U/11.3.0.2, Server, ServiceNow, Servlet 2.5; JBoss-5.0/JBossWeb-2.1, Servlet/2.5 JSP/2.1, SimpleHTTP/0.6 Python/2.7.15+, SinforHttpd/1.0, SmartXFilter, SoftManager Application Server, SonicWALL, Spark, Start HTTP-Server/1.1, Sun GlassFish Enterprise Server v2.1.1, Swift1.0, Switch, SyncThru 5, TOPSEC, TP-LINK Router, TWebAP/2.1.2.9, Tas, Techno Vision Security System Ver. 2.0, Tengine/2.3.2, Thecapital Caphe Websphere 12.3 build 3.456.234.2600, This is webserver, TibetSystem Server 2.0, Tieline, Tntnet/2.1, Topsec, TornadoServer/6.0.2, TurnStat webserver, TwistedWeb/18.9.0, U S Software Web Server, UBNT Streaming Server v1.2, UCS PremieraExternal v4.0.4.24, UMC Webserver/5.0, UPnP/1.0 DLNADOC/1.50 Allwinnertech/0.1.0, UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13, Unknown, Unspecified, UPnP/1.0, Unspecified, VAppServer/6.0.0, VB, VB100, VCS-VideoJet-Webserver, VPON Server/1.0, Varnish, Vinahost, Virata-EmWeb/R6_0_1, Virtual Web 0.9, Vivotek Network Camera, WAF, WCY_WEBServer/1.0, WCY_WEBServer/2.0, WDaemon/10.0.0, WDaemon/4.0, WEB SERVER, WMSServer/2.0.1.0, WN/2.4.7, WS CDN Server, WSGIServer/0.2 CPython/3.7.3, WWW Server/1.1, WWW-Kodeks/6.4, Warp/3.2.27, Warp/3.2.28, Waveplus HTTPD, Web Express 0.9, Web Server, Web Switch, Web server, Web-Server/3.0, WebServer, WebServer/1.0 UPnP/1.0, Webs, WebsServer/2.1.8 PeerSec-MatrixSSL/, Werkzeug/0.9.6 Python/2.7.6, WhatsUp, WhatsUp_Gold/8.0, WiJungle, WildDuck API, WildFly/10, WildFly/11, WildFly/8, WildFly/9, WindRiver-WebServer/4.7, WindWeb/1.0, Windows Server 2008 R2, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Wing FTP Server(Mario Kaserer), Wing FTP Server(MediaSend pty Ltd), Wing FTP Server/3.3.5(), Winstone Servlet Engine v0.9.10, Wisp/1.0.71.15, WowzaStreamingEngine/4.7.1, WowzaStreamingEngine/4.7.7, XDaemon v1.0, XEvil_4.0.0[Beta][V4_0b25], Xavante 2.2.0 embeded, Xitami, Yawcam, YouTrack, YxlinkWAF, ZK Web Server, ZSWS/2.2, ZTE web server 1.0 ZTE corp 2015., Zope/(2.13.15, python 2.7.3, linux2) ZServer/1.1, Zope/(2.13.27, python 2.7.3, linux2) ZServer/1.1, Zscaler/5.7, abcd, access to tenda, alphapd, alphapd/2.1.7, alphapd/2.1.8, antid, axhttpd/1.4.0, axhttpd/1.5.3, beegoServer:1.12.0, bots-webserver, box, build-in http server, calibre 4.0.0, ccapi-dvrs-production, cisco-IOS, cloudflare, cloudflare-nginx, cvmd-1.0.0 (r1), dcs-lig-httpd, de475d6363d3b9295c4645cd08294af288c1c0de, eHTTP v2.0, eboo server, embedded http dameon, falcon/2.1, foo, gSOAP/2.7, gen5th/1.33.00, gen5th/1.82.01, go1984, gunicorn/19.3.0, h2o/2.3.0-DEV@6cde7eb3f, http server 1.0, httpd, httpd/1.00, httpd/2.0, httpd_four-faith, httpserver, i-Catcher Console, iSpy, jjhttpd v0.1.0, kangle/3.5.8.2, kong/0.14.0, libwww-perl-daemon/6.01, lighttpd, lighttpd-Intelbras, lighttpd/1.4.28, lighttpd/1.4.35, lighttpd/1.4.43, lighttpd/1.4.54, localhost, lwIP/1.4.0 (http://savannah.nongnu.org/projects/lwip), m"],"content_type":["text/html; charset=UTF-8"],"content_length":["56889"]},"status_code":200,"body_sha256":"9635d37cb4b5739d40724df73492ddff1aa5e93e040df5bda14da08b18417335","meta":["charset=\"utf-8\" ","http-equiv=\"refresh\" content=\"0; URL=/cgi-bin/luci\" ","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"http://srv4.anderl-it.de:8089\"","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","name=\"application-name\" content=\"JIRA\" data-name=\"jira\" data-version=\"7.2.6\"","name=\"ajs-dev-mode\" content=\"false\"","name=\"generator\" content=\"Joomla! - Open Source Content Management\" "],"tracker":{"google_analytics":["G-S"]},"title":"28ZE","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Apache Tomcat/9.0.59

\n\n","status_line":"200 OK","version":"1.1","content_length":56889},"tag":[{"embedthis_appweb":{"version":"3.2.3"},"name":"embedthis_appweb","cpe":["cpe:2.3:a:embedthis:appweb:3.2.3:*:*:*:*:*:*:*"],"fullname":"EmbedThis Appweb","category":["Web servers"]},{"name":"jetty","jetty":{"version":"6.1.19"},"fullname":"Jetty","category":["Web servers"]},{"name":"miniserv","fullname":"MiniServ","category":["Web servers"],"miniserv":{"version":"1.890"}},{"name":"centos","cpe":["cpe:2.3:o:centos:centos:*:*:*:*:*:*:*:*"],"description":"CentOS is a Linux distribution that provides a free, community-supported computing platform functionally compatible with its upstream source, Red Hat Enterprise Linux (RHEL).","fullname":"CentOS","category":["Operating systems"],"centos":{"version":""}},{"name":"goahead","cpe":["cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*"],"goahead":{"version":""},"fullname":"GoAhead","category":["Web servers"]},{"name":"perl","cpe":["cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"],"description":"Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages.","perl":{"version":""},"fullname":"Perl","category":["Programming languages"]},{"java":{"version":""},"name":"java","cpe":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","fullname":"Java","category":["Programming languages"]},{"ubuntu":{"version":""},"name":"ubuntu","cpe":["cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*"],"description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","fullname":"Ubuntu","category":["Operating systems"]},{"name":"simplehttp","fullname":"SimpleHTTP","category":["Web servers"],"simplehttp":{"version":"0.6"}},{"red_hat":{"version":""},"name":"red_hat","cpe":["cpe:2.3:o:redhat:linux:*:*:*:*:*:*:*:*"],"description":"Red Hat is an open-source Linux operating system.","fullname":"Red Hat","category":["Operating systems"]},{"twistedweb":{"version":"18.9.0"},"name":"twistedweb","fullname":"TwistedWeb","category":["Web servers"]},{"name":"tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","fullname":"Tengine","category":["Web servers"],"tengine":{"version":""}},{"monkey_http_server":{"version":""},"name":"monkey_http_server","fullname":"Monkey HTTP Server","category":["Web servers"]},{"debian":{"version":""},"name":"debian","cpe":["cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*"],"description":"Debian is a Linux software which is a free open-source software.","fullname":"Debian","category":["Operating systems"]},{"name":"tornadoserver","fullname":"TornadoServer","category":["Web servers"],"tornadoserver":{"version":"6.0.2"}},{"name":"indy","fullname":"Indy","indy":{"version":"9.0.11"},"category":["Web servers"]},{"name":"oracle_application_server","cpe":["cpe:2.3:a:oracle:application_server:10g/10.1.2.0.2:*:*:*:*:*:*:*"],"fullname":"Oracle Application Server","category":["Web servers"],"oracle_application_server":{"version":"10g/10.1.2.0.2"}},{"name":"angularjs","cpe":["cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*"],"description":"AngularJS is a JavaScript-based open-source web application framework led by the Angular Team at Google.","fullname":"AngularJS","category":["JavaScript frameworks"],"angularjs":{"version":""}},{"oracle_http_server":{"version":""},"name":"oracle_http_server","cpe":["cpe:2.3:a:oracle:http_server:*:*:*:*:*:*:*:*"],"fullname":"Oracle HTTP Server","category":["Web servers"]},{"cherrypy":{"version":"2.3.0"},"name":"cherrypy","description":"CherryPy is an object-oriented web application framework using the Python programming language.","fullname":"CherryPy","category":["Web servers"]},{"openssl":{"version":"1.0.2k"},"name":"openssl","cpe":["cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*"],"description":"OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.","fullname":"OpenSSL","category":["Web server extensions"]},{"libwww_perl_daemon":{"version":"6.01"},"name":"libwww_perl_daemon","fullname":"libwww-perl-daemon","category":["Web servers"]},{"name":"xitami","xitami":{"version":""},"fullname":"Xitami","category":["Web servers"]},{"python":{"version":"2.7.5"},"name":"python","cpe":["cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*"],"description":"Python is an interpreted and general-purpose programming language.","fullname":"Python","category":["Programming languages"]},{"winstone_servlet_container":{"version":"0.9.10"},"name":"winstone_servlet_container","fullname":"Winstone Servlet Container","category":["Web servers"]},{"name":"php","cpe":["cpe:2.3:a:php:php:7.3.11:*:*:*:*:*:*:*"],"description":"PHP is a general-purpose scripting language used for web development.","php":{"version":"7.3.11"},"fullname":"PHP","category":["Programming languages"]},{"apache_tomcat":{"version":""},"name":"apache_tomcat","cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"],"description":"Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.","fullname":"Apache Tomcat","category":["Web servers"]},{"mod_jk":{"version":"1.2.46"},"name":"mod_jk","description":"Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.","fullname":"mod_jk","category":["Web server extensions"]},{"name":"apache_http_server","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"description":"Apache is a free and open-source cross-platform web server software.","fullname":"Apache HTTP Server","category":["Web servers"],"apache_http_server":{"version":"2.2.15"}},{"name":"openresty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","fullname":"OpenResty","openresty":{"version":""},"category":["Web servers"]},{"name":"windows_ce","description":"Windows CE is an operating system designed for small footprint devices or embedded systems.","fullname":"Windows CE","windows_ce":{"version":""},"category":["Operating systems"]},{"microsoft_httpapi":{"version":"2.0"},"name":"microsoft_httpapi","description":"Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.","fullname":"Microsoft HTTPAPI","category":["Web servers"]},{"name":"ibm_http_server","cpe":["cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*"],"fullname":"IBM HTTP Server","ibm_http_server":{"version":""},"category":["Web servers"]},{"name":"gunicorn","fullname":"gunicorn","gunicorn":{"version":"19.3.0"},"category":["Web servers"]},{"webmin":{"version":""},"name":"webmin","description":"Webmin is a free, open-source application for Linux server administration.","fullname":"Webmin","category":["Miscellaneous"]},{"glassfish":{"version":""},"name":"glassfish","cpe":["cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*"],"fullname":"GlassFish","category":["Web servers"]},{"name":"thttpd","cpe":["cpe:2.3:a:acme:thttpd:*:*:*:*:*:*:*:*"],"thttpd":{"version":""},"fullname":"thttpd","category":["Web servers"]},{"name":"flask","cpe":["cpe:2.3:a:palletsprojects:flask:0.9.6:*:*:*:*:*:*:*"],"description":"Flask is a Python micro web framework ideal for rapidly constructing web applications, offering minimalism, flexibility, and modularity.","fullname":"Flask","flask":{"version":"0.9.6"},"category":["Web frameworks","Web servers"]},{"name":"couchdb","cpe":["cpe:2.3:a:apache:couchdb:1.6.1:*:*:*:*:*:*:*"],"fullname":"CouchDB","category":["Web servers"],"couchdb":{"version":"1.6.1"}},{"name":"mochiweb","cpe":["cpe:2.3:a:mochiweb_project:mochiweb:1.0:*:*:*:*:*:*:*"],"fullname":"MochiWeb","mochiweb":{"version":"1.0"},"category":["Web servers"]},{"lighttpd":{"version":""},"name":"lighttpd","description":"Lighttpd is an open-source web server optimised for speed-critical environment.","fullname":"lighttpd","category":["Web servers"]},{"name":"erlang","erlang":{"version":"otp/18"},"cpe":["cpe:2.3:a:erlang:erlang%2fotp:otp/18:*:*:*:*:*:*:*"],"description":"Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.","fullname":"Erlang","category":["Programming languages"]},{"nginx":{"version":""},"name":"nginx","cpe":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*"],"description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","fullname":"Nginx","category":["Web servers","Reverse proxies"]},{"name":"apache_traffic_server","cpe":["cpe:2.3:a:apache:traffic_server:5.3.0:*:*:*:*:*:*:*"],"description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","fullname":"Apache Traffic Server","category":["Web servers"],"apache_traffic_server":{"version":"5.3.0"}},{"mini_httpd":{"version":"1.19"},"name":"mini_httpd","fullname":"mini_httpd","category":["Web servers"]},{"name":"allegro_rompager","allegro_rompager":{"version":"4.06"},"fullname":"Allegro RomPager","category":["Web servers"]},{"apache":{"version":"2.2.15"},"name":"apache","description":"Apache is a free and open-source cross-platform web server software.","cpe":["cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*"],"fullname":"Apache","category":["Web servers"]},{"boa":{"version":"0.93.15"},"name":"boa","cpe":["cpe:2.3:a:boa:boa:0.93.15:*:*:*:*:*:*:*"],"fullname":"Boa","category":["Web servers"]},{"name":"connectwise","description":"ConnectWise Control is a self-hosted remote desktop software application owned by Connectwise Inc.","cpe":["cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*"],"fullname":"ConnectWise","category":["Issue trackers"],"connectwise":{"version":""}},{"name":"samsung_dvr","fullname":"Web Viewer for Samsung DVR","samsung_dvr":{"version":""},"category":["Web cameras"]},{"zxhn_h_108n":{"version":"2.5"},"name":"zxhn_h_108n","fullname":"ZXHN H108N","category":["Router"]},{"name":"dlink","fullname":"D-Link router","category":["Router"],"dlink":{"version":""}},{"name":"nethserver","fullname":"NethServer Linux distribution","category":["Operating systems"],"nethserver":{"version":""}}],"scan_date":"2026-08-07"},"scan_label":"2026-08-07"},{"highlight":{"http.headers.server":"yawcam/0.6.0"},"data":{"isp":"UPC Schweiz","ip":"178.83.207.119","uri":"http://178.83.207.119:8888/","host_type":"ip","prot7":"http","target":{"ip":"178.83.207.119","type":"ip"},"geo":{"continent":"Europe","country":"CH","city":"Pfaeffikon","tz":"Europe/Zurich","accuracy":5,"location":{"lon":8.7832,"lat":47.2052},"postal":"8808","registered_country":"CH","subdivisions":["Schwyz"]},"path":"/","protocol":"http","prot4":"tcp","cve":[{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.0","integrity_impact":"HIGH","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\"s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage ...","published":"2026-03-24T00:16:28.987","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33195","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ruby on Rails"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and ...","published":"2024-06-04T20:15:10.237","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-28103","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ruby on Rails"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so ...","published":"2024-02-27T16:15:46.600","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-26142","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.3","integrity_impact":"NONE","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage\"s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with ...","published":"2026-03-26T22:16:29.387","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-33658","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.6","integrity_impact":"HIGH","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\"s `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob ...","published":"2026-03-24T00:16:29.157","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-33202","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.6","integrity_impact":"NONE","description":"Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), ...","published":"2026-03-24T00:16:28.807","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-33176","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.6","integrity_impact":"NONE","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage\"s proxy delivery mode, the proxy controller loads the entire requested byte ...","published":"2026-03-24T00:16:28.630","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-33174","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags ...","published":"2026-03-24T00:16:28.457","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"PASSIVE","name":"CVE-2026-33173","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"LOW","description":"Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a ...","published":"2026-03-24T00:16:28.287","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"PASSIVE","name":"CVE-2026-33170","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.9","integrity_impact":"NONE","description":"Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, ...","published":"2026-03-24T00:16:28.113","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-33169","match_type":"product","confidentiality_impact":"NONE","match_product":"Ruby on Rails"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large ...","published":"2024-02-10T05:15:08.650","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-21490","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/RoninForge/roninforge-angularjs-migration"],"match_product":"AngularJS"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.7","integrity_impact":"HIGH","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a ...","published":"2026-08-04T17:16:46.127","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-15307","match_type":"product","confidentiality_impact":"HIGH","match_product":"Django"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series ...","published":"2026-04-07T15:17:46.500","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-4277","match_type":"product","confidentiality_impact":"HIGH","match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single ...","published":"2026-04-07T15:17:46.353","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-3902","match_type":"product","confidentiality_impact":"NONE","match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing ...","published":"2026-04-07T15:17:39.393","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-33034","match_type":"product","confidentiality_impact":"NONE","match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode ...","published":"2026-03-03T15:16:19.103","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-25673","match_type":"product","confidentiality_impact":"NONE","match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow ...","published":"2026-02-03T15:16:13.570","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-1285","match_type":"product","confidentiality_impact":"NONE","match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django ...","published":"2026-02-03T15:16:11.750","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-14550","match_type":"product","confidentiality_impact":"NONE","match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering ...","published":"2025-12-02T16:15:56.013","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-64460","match_type":"product","confidentiality_impact":"NONE","match_product":"Django"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","has_exploit":true,"description":"An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted ...","published":"2025-11-05T15:15:41.080","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2025-64459","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html","https://github.com/rockmelodies/django_sqli_target_CVE-2025-64459","https://github.com/nunpa/CVE-2025-64459","https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed","https://github.com/0xCyberstan/CVE-2025-64459-Poc","https://github.com/Z3YR0xX/CVE-2025-64459","https://github.com/alxsourin/Helpdesk-Telecom-CVE-2025-64459","https://github.com/purehate/CVE-2025-64459-hunter","https://github.com/joshualent/django-cve-2025-64459","https://github.com/rafaelchriss/RedTeamBrasil-CVE-2025-64459","https://github.com/YouGina/CVE-2025-64459"],"match_product":"Django"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut ...","published":"2025-11-05T15:15:40.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-64458","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/ch4n3-yoon/CVE-2025-64458-Demo"],"match_product":"Django"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and ...","published":"2026-07-17T20:17:28.490","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-63030","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Icex0/wp2shell-poc","https://github.com/attackercan/wp2shell-poc2","https://github.com/ZephrFish/wp2shell-scanner","https://github.com/Senanfurkan/wordpress-cve-2026-63030","https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause","https://github.com/dinosn/wp2shell-lab","https://github.com/47Cid/wp2shell-lab","https://github.com/Lutfifakee-Project/wp2shell","https://github.com/ekomsSavior/wp2shell","https://github.com/NULL200OK/WP2Shell","https://github.com/kulichr/wp2shell","https://github.com/CybersecSpirit/CVE-2026-63030","https://github.com/4minx/CVE-2026-63030","https://github.com/mverschu/CVE-2026-63030","https://github.com/0xsha/wp2shell","https://github.com/J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t","https://github.com/gbrsh/CVE-2026-63030","https://github.com/0xBlackash/CVE-2026-63030","https://github.com/mrx-arafat/CVE-2026-63030-POC","https://github.com/0xWhoknows/wp2shell","https://github.com/zi3lak/wp2shell_scanner","https://github.com/ebrasha/abdal-cve-2026-63030","https://github.com/securelayer7/WordPresShell","https://github.com/fullhunt/wp2shell-scan","https://github.com/ChiefYoru/CVE-2026-63030_PoC","https://github.com/own2pwn-fr/wp2shell-detect","https://github.com/JohenLastGen-JLG/wp2shell","https://github.com/mhtsec/CVE-2026-63030","https://github.com/c0gnit00/Wp2Shell","https://github.com/ikow/wp2shell","https://github.com/TomorrowX6/CVE-2026-63030-poc","https://github.com/bahartanir/wp2shell-scanner","https://github.com/eyesecurity/wp2shell-compromise-scanner-plugin","https://github.com/0xh7ml/CVE-2026-63030","https://github.com/4B3R4M4-607D/CVE-2026-63030-POC","https://github.com/InstaWP/wp2shell-scan","https://github.com/hidden-investigations/wp2shell-scanner","https://github.com/ananay/wp2shell-lab","https://github.com/Lukols-Dev/wp-cve-2026-63030-check","https://github.com/skelersecurity/wordpress-skelersecurity-core-security-CVE-2026-63030","https://github.com/vulnquest58/PressVector","https://github.com/ZenithGenius/wordpress-batch-rce-lab","https://github.com/Crypto-Cat/wp2shell","https://github.com/administrator-01001/CVE-2026-63030","https://github.com/joaovicdev/EXPLOIT-CVE-2026-63030","https://github.com/0xjessie21/wp2shell-checker","https://github.com/Iqbalx7/wp2shell","https://github.com/SentinelXofficial/sxwp2shell","https://github.com/GhostInExile/CVE-2026-63030-Wp2Shell","https://github.com/lucifer0xf/wp2shell-Wordpress-TOWN","https://github.com/Ch4120N/CVE-2026-63030","https://github.com/Bhanunamikaze/WP2Shell-CVE-2026-63030-POC","https://github.com/mcipekci/wp2shell","https://github.com/Adrees-Basheer/wp2shell-vulnerability-scanner","https://github.com/raphy76/wp2shell-poc-fulljs","https://github.com/gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc","https://github.com/razureink/cve-2026-63030_60137-wordpress_rce_reproduction","https://github.com/Giangdurian/CVE-2026-63030-CVE-2026-60137","https://github.com/shinthink/CVE-2026-63030","https://github.com/imXur/WordPress-CVE-2026-63030-Analysis","https://github.com/yuag/wp2shell","https://github.com/BytesPulse-OE/wp2shell-Hestia-Scanner","https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-63030-WP2Shell","https://github.com/johnlodan/wp2shell-rce","https://github.com/Procjevt/CVE-2026-63030","https://github.com/x-znn/CVE-2026-63030","https://github.com/rechandra/wp2exp-2026","https://github.com/minwunn/wp2shell-CVE-2026-63030","https://github.com/sowarma/wp2shell-PoC","https://github.com/AnggaTechI/CVE-2026-63030","https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass","https://github.com/g0d150ne/WP2Shell"],"match_product":"WordPress"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior ...","published":"2024-04-04T23:15:16.333","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-31211","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Abdurahmon3236/-CVE-2024-31211"],"match_product":"WordPress"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.8","integrity_impact":"HIGH","description":"WordPress is an open publishing platform for the Web. It\"s possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials ...","published":"2024-04-04T23:15:16.127","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"REQUIRED","name":"CVE-2024-31210","match_type":"product","confidentiality_impact":"HIGH","match_product":"WordPress"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"5.9","integrity_impact":"NONE","has_exploit":true,"description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","published":"2026-07-17T20:17:27.790","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2026-60137","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/h4cd0c/wp2shell","https://github.com/ebrasha/abdal-cve-2026-60137","https://github.com/codeb0ssx/Ultimate-wp2shell","https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","https://github.com/Colere-Sys/wp2shell-poc","https://github.com/northsia/CVE-2026-60137-With-Skip-SSL","https://github.com/Dungsocool/CVE-2026-60137_CVE-2026-63030","https://github.com/michael-kanda/Wp2shell-ioc-scanner","https://github.com/AdarshThakur14777-cyber/CVE-2026-60137","https://github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC"],"match_product":"WordPress"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.4","integrity_impact":"LOW","description":"WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it ...","published":"2024-10-16T07:15:12.497","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2022-4973","match_type":"product","confidentiality_impact":"LOW","match_product":"WordPress"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"6.1","integrity_impact":"LOW","has_exploit":true,"description":"WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with ...","published":"2024-05-03T06:15:14.947","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2024-4439","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://www.wordfence.com/blog/2024/04/unauthenticated-stored-cross-site-scripting-vulnerability-patched-in-wordpress-core/","https://www.wordfence.com/blog/2024/04/unauthenticated-stored-cross-site-scripting-vulnerability-patched-in-wordpress-core/","https://github.com/MielPopsssssss/CVE-2024-4439","https://github.com/d0rb/CVE-2024-4439","https://github.com/xssor-dz/-CVE-2024-4439","https://github.com/soltanali0/CVE-2024-4439","https://github.com/w0r1i0g1ht/CVE-2024-4439"],"match_product":"WordPress"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.3","integrity_impact":"NONE","has_exploit":true,"description":"WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack","published":"2023-10-16T20:15:18.073","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-5561","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://github.com/pog007/CVE-2023-5561-PoC","https://github.com/rootxsushant/CVE-2023-5561-POC-Updated","https://github.com/dthkhang/CVE-2023-5561-PoC"],"match_product":"WordPress"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.3","integrity_impact":"NONE","has_exploit":true,"description":"Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 ...","published":"2023-10-13T12:15:09.970","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-39999","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve"],"match_product":"WordPress"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"5.4","integrity_impact":"LOW","has_exploit":true,"description":"Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.","published":"2023-10-13T10:15:09.823","attack_vector":"NETWORK","privileges_required":"LOW","availability_impact":"NONE","user_interaction":"REQUIRED","name":"CVE-2023-38000","match_type":"product","confidentiality_impact":"LOW","exploit_links":["https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve"],"match_product":"WordPress"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.7","integrity_impact":"NONE","description":"The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.","published":"2026-07-09T17:16:58.260","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-15308","match_type":"product","confidentiality_impact":"NONE","match_product":"Python"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.0","integrity_impact":"HIGH","description":"The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().","published":"2026-03-20T15:16:24.057","attack_vector":"LOCAL","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"ACTIVE","name":"CVE-2026-4519","match_type":"product","confidentiality_impact":"HIGH","match_product":"Python"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.","published":"2024-09-03T13:15:05.363","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-6232","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/python/cpython/issues/121285","https://github.com/bgutowski/CVE-2025-4517-POC-Sudoers"],"match_product":"Python"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"There is a LOW severity vulnerability affecting CPython, specifically the \"http.cookies\" standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with ...","published":"2024-08-19T19:15:08.180","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-7592","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/python/cpython/issues/123067"],"match_product":"Python"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"HIGH","description":"An issue was discovered in Python 3.11 through 3.11.4. If a path containing \"\\0\" bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first \"\\0\" byte. There are plausible cases in which an application would have ...","published":"2023-08-23T07:15:08.590","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2023-41105","match_type":"product","confidentiality_impact":"NONE","match_product":"Python"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.8","integrity_impact":"HIGH","has_exploit":true,"description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.","published":"2023-08-22T19:16:32.007","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48565","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://bugs.python.org/issue42051","https://github.com/Einstein2150/CVE-2022-48565-POC"],"match_product":"Python"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","has_exploit":true,"description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq.","published":"2023-08-22T19:16:31.827","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2022-48560","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://bugs.python.org/issue39421"],"match_product":"Python"},{"severity":"LOW","attack_complexity":"LOW","base_score":"2.0","integrity_impact":"LOW","description":"In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing ...","published":"2026-06-30T15:16:57.193","attack_vector":"NETWORK","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"PASSIVE","name":"CVE-2026-4360","match_type":"product","confidentiality_impact":"NONE","match_product":"Python"},{"severity":"MEDIUM","attack_complexity":"LOW","base_score":"4.1","integrity_impact":"HIGH","description":"When using the \"configparser\" module to write configuration files containing multi-line text values with carriage return characters (\\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.","published":"2026-06-23T18:17:41.243","attack_vector":"LOCAL","privileges_required":"HIGH","availability_impact":"NONE","user_interaction":"PASSIVE","name":"CVE-2026-0864","match_type":"product","confidentiality_impact":"NONE","match_product":"Python"},{"severity":"MEDIUM","attack_complexity":"HIGH","base_score":"6.3","integrity_impact":"NONE","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to ...","published":"2026-05-11T18:16:42.413","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"LOW","user_interaction":"NONE","name":"CVE-2026-7210","match_type":"product","confidentiality_impact":"NONE","match_product":"Python"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","published":"2026-07-30T12:17:27.347","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-17544","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/Boreas37/CVE-2026-17544-PoC","https://github.com/r2qa/CVE-2026-17544"],"match_product":"PHP"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.1","integrity_impact":"HIGH","has_exploit":true,"description":"Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.","published":"2026-07-30T12:17:27.120","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-17543","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/pratham220/CVE-2026-17543-PHP-Exposure-Validator","https://github.com/Hunt-Benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout"],"match_product":"PHP"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.3","integrity_impact":"HIGH","has_exploit":true,"description":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) ...","published":"2026-05-10T05:16:11.213","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"PASSIVE","name":"CVE-2026-6735","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv"],"match_product":"PHP"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.5","integrity_impact":"HIGH","description":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension\"s object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When ...","published":"2026-05-10T05:16:11.070","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-6722","match_type":"product","confidentiality_impact":"HIGH","match_product":"PHP"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.4","integrity_impact":"HIGH","description":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing ...","published":"2026-05-10T05:16:09.853","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"ACTIVE","name":"CVE-2025-14179","match_type":"product","confidentiality_impact":"HIGH","match_product":"PHP"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.2","integrity_impact":"NONE","has_exploit":true,"description":"In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a ...","published":"2025-12-27T20:15:40.717","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-14180","match_type":"product","confidentiality_impact":"NONE","exploit_links":["https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj"],"match_product":"PHP"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"8.2","integrity_impact":"LOW","description":"In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, ...","published":"2025-12-27T20:15:40.570","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-14178","match_type":"product","confidentiality_impact":"NONE","match_product":"PHP"},{"severity":"HIGH","attack_complexity":"LOW","base_score":"7.5","integrity_impact":"NONE","description":"In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string ...","published":"2025-07-13T23:15:22.940","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2025-1735","match_type":"product","confidentiality_impact":"NONE","match_product":"PHP"},{"severity":"CRITICAL","attack_complexity":"HIGH","base_score":"9.2","integrity_impact":"HIGH","has_exploit":true,"description":"In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example ...","published":"2025-04-04T18:15:48.020","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2024-11235","match_type":"product","confidentiality_impact":"HIGH","exploit_links":["https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477","https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477"],"match_product":"PHP"},{"severity":"CRITICAL","attack_complexity":"LOW","base_score":"9.1","integrity_impact":"HIGH","description":"In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further ...","published":"2025-02-12T22:15:29.007","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"NONE","user_interaction":"NONE","name":"CVE-2022-31631","match_type":"product","confidentiality_impact":"HIGH","match_product":"PHP"},{"severity":"HIGH","attack_complexity":"HIGH","base_score":"8.1","integrity_impact":"HIGH","description":"An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user- ...","published":"2026-05-22T18:16:22.927","attack_vector":"NETWORK","privileges_required":"NONE","availability_impact":"HIGH","user_interaction":"NONE","name":"CVE-2026-46727","match_type":"product","confidentiality_impact":"HIGH","match_product":"Ruby"}],"@timestamp":"2026-08-19T21:59:21.594Z","port":8888,"whois":{"abuse":"report@abuseradar.com","related_nets":[{"created":"2026-05-25T16:16:45Z","start_ip":"178.83.206.0","range":"178.83.206.0 - 178.83.207.255","net_size":511,"cidr":["178.83.206.0/23"],"end_ip":"178.83.207.255","updated":"2026-05-25T16:16:45Z"},{"created":"2026-05-25T16:16:45Z","start_ip":"178.83.206.0","range":"178.83.206.0 - 178.83.207.255","net_size":511,"cidr":["178.83.206.0/23"],"end_ip":"178.83.207.255","updated":"2026-05-25T16:16:45Z"}],"net":{"country":"CH","address":"Regent street 207\nW1B 3HH\nLondon\nUNITED KINGDOM","created":"2025-12-19T08:46:41Z","range":"178.83.128.0 - 178.83.255.255","handle":"NU834","organization":"ORG-IL687-RIPE","start_ip":"178.83.128.0","name":"NET-178-83-128-0-17","cidr":["178.83.128.0/17"],"net_size":32767,"updated":"2025-12-19T08:46:41Z","end_ip":"178.83.255.255","contacts":{"phones":["+370 699 08833"]}},"asn":{"registry":"ripencc","number":["151419"],"country":"GB","name":"LINKLESS-AS-AP - LINKLESS COMMUNICATIONS LIMITED","cidr":"178.83.206.0/23","updated":"2009-12-14"}},"host":"178.83.207.119","http":{"headers":{"date":["Wed, 19 Aug 2026 21:57:27 GMT"],"server":["yawcam/0.6.0"],"content_type":["application/xml; charset=UTF-8"],"content_length":["174417"]},"status_code":400,"body_sha256":"4efb85836968ca42424041a77c7f45733deead65959d4e5cd8f67ed6b7daa799","meta":["http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" ","http-equiv=\"X-UA-Compatible\" content=\"IE=edge\"","http-equiv=\"Pragma\" content=\"no-cache\" ","charset=\"utf-8\"","content=\"IE=edge\" http-equiv=\"X-UA-Compatible\"","content=\"object\" property=\"og:type\"","content=\"GitLab\" property=\"og:site_name\"","content=\"Help\" property=\"og:title\"","content=\"GitLab Community Edition\" property=\"og:description\"","content=\"summary\" property=\"twitter:card\"","content=\"Help\" property=\"twitter:title\"","content=\"GitLab Community Edition\" property=\"twitter:description\"","content=\"GitLab Community Edition\" name=\"description\"","content=\"#474D57\" name=\"theme-color\"","content=\"#30353E\" name=\"msapplication-TileColor\"","name=\"csrf-param\" content=\"authenticity_token\" ","name=\"csrf-token\" content=\"8dcb74a64dc984fb9abe3e7c201f810d9ec90ed8e7c96eda39b99be1fec23b082b==\" ","http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"","http-equiv=\"expires\" content=\"-1\"","name=\"keywords\" content=\"VOS3000, VoIP, VoIP运营支撑系统, 软交换\"","name=\"author\" content=\"www.linknat.com, 昆石网络\"","name=\"copyright\" content=\"www.linknat.com, 昆石网络\"","name=\"generator\" content=\"SPIP 4.1.11\" ","id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\"","id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"https://192.168.1.4\"","id=\"atlassian-token\" name=\"atlassian-token\" content=\"d78e2b977d28428e411e31b958c9c502c2425083\"","name=\"generator\" content=\"vBulletin 5.5.4\" ","name=\"confluence-request-time\" content=\"1698802962782\"","name=\"title\" content=\"Document | DBMS | Database | Java | Studio\" ","name=\"description\" content=\"OrientDB Studio\" ","charset=\"UTF-8\"","http-equiv=\"X-UA-Compatible\" content=\"IE=edge\"","name=\"description\" content=\"Build Your Own Botnet\" ","name=\"keywords\" content=\"VOS3000, VoIP, VoIP运营支撑系统, 软交换\"","name=\"description\" content=\"VOS3000, VoIP, VoIP运营支撑系统, 软交换\""],"tracker":{"google_analytics":["G-IP","GT-AC5300","GT-AC2900","GT-AX11000","GT-AX6000","G-GR1321","G-HR3400","G-SC385","G-SW155","G-NVR16P","G-NVR8P","G-1421G","G-1402G","G-714GXW","G-ACE","G-BOX"]},"description":"OrientDB Studio","title":"NETCORE NR289-GE,NETCORE NR289-GE","body":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \nNETCORE NR289-GE,NETCORE NR289-GE\n\n\n

\n\na29d421feecf680a680a0fritzr\n\n\n\n\n\n\n\n\n\n\n

8.5.5 (Build:20200530.307-TEMP)

\nVersion 2023.11.3 (build 147512)\n

Logged in as admin

\n\n

\n The zip file did not contain an entry exportDescriptor.properties\n \n Please enter your username and password.\n \n \n \n

The Cacti Group Version 1.2.25

\n IPFire 2.19 (2017v) - Core Update 110 introduces significant changes\n \n \n \n \n \n \n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n \n \n \n \n \n \n

v7.0NG.772.3

\n\n\n22.7R2.0\n

downloadLog_154

Log_154

\n\n\n\n

日志系统

云平台

\n\n

RT-AC5300

\nPHP Group\nupload_tmp_dir/etc/httpd/_tmp/etc/httpd/_tmp\n$_SERVER['DOCUMENT_ROOT']/mnt/HDD2/web/\n7db3eea5-9996-4032-a9cc-3afd06bd11fe\nPowered by Gibbon v23.0.01\n

Openfire, Version: 3.6.0a

\nIP.Board\n

LoadMaster

出厂IP：192.168.1.1
用户名、密码：admin admin

\nPlease enter your Cacti user name and password below:\n\n\n\n\n

java.lang.Exception: y9pcHMuY

\nSonicWall Universal Management Suite v9.3\n
OK
\n\n\nMODIFY\n\n $\"K1000$ \n\n