SHARE
TWEET

Anonymous JTSEC #OpISIS Full Recon #19

JTSEC1333 Nov 19th, 2019 435 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ######################################################################################################################################
  2. =======================================================================================================================================
  3. Hostname    tlwen.com       ISP     SingleHop LLC
  4. Continent   North America       Flag    
  5. US
  6. Country     United States       Country Code    US
  7. Region  Illinois        Local time  19 Nov 2019 15:12 CST
  8. City    Chicago         Postal Code     60604
  9. IP Address  184.154.7.82        Latitude    41.878
  10. =======================================================================================================================================
  11. #######################################################################################################################################
  12. > tlwen.com
  13. Server:     185.93.180.131
  14. Address:    185.93.180.131#53
  15.  
  16. Non-authoritative answer:
  17. Name:   tlwen.com
  18. Address: 184.154.7.82
  19. >
  20. #######################################################################################################################################
  21.    Domain Name: TLWEN.COM
  22.    Registry Domain ID: 2039148583_DOMAIN_COM-VRSN
  23.    Registrar WHOIS Server: whois.namesilo.com
  24.    Registrar URL: http://www.namesilo.com
  25.    Updated Date: 2018-03-02T02:14:29Z
  26.    Creation Date: 2016-07-01T22:33:01Z
  27.    Registry Expiry Date: 2022-07-01T22:33:01Z
  28.    Registrar: NameSilo, LLC
  29.    Registrar IANA ID: 1479
  30.    Registrar Abuse Contact Email: abuse@namesilo.com
  31.    Registrar Abuse Contact Phone: +1.4805240066
  32.    Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
  33.    Name Server: NS1.S11.FCOMET.COM
  34.    Name Server: NS2.S11.FCOMET.COM
  35.    DNSSEC: unsigned
  36. ######################################################################################################################################
  37. Domain Name: tlwen.com
  38. Registry Domain ID: 2039148583_DOMAIN_COM-VRSN
  39. Registrar WHOIS Server: whois.namesilo.com
  40. Registrar URL: https://www.namesilo.com/
  41. Updated Date: 2019-10-31T07:00:00Z
  42. Creation Date: 2016-07-01T07:00:00Z
  43. Registrar Registration Expiration Date: 2022-07-01T07:00:00Z
  44. Registrar: NameSilo, LLC
  45. Registrar IANA ID: 1479
  46. Registrar Abuse Contact Email: abuse@namesilo.com
  47. Registrar Abuse Contact Phone: +1.4805240066
  48. Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
  49. Registry Registrant ID:
  50. Registrant Name: Domain Administrator
  51. Registrant Organization: See PrivacyGuardian.org
  52. Registrant Street: 1928 E. Highland Ave. Ste F104 PMB# 255
  53. Registrant City: Phoenix
  54. Registrant State/Province: AZ
  55. Registrant Postal Code: 85016
  56. Registrant Country: US
  57. Registrant Phone: +1.3478717726
  58. Registrant Phone Ext:
  59. Registrant Fax:
  60. Registrant Fax Ext:
  61. Registrant Email: pw-7b1809281f339bb93978dfeec6d6210a@privacyguardian.org
  62. Registry Admin ID:
  63. Admin Name: Domain Administrator
  64. Admin Organization: See PrivacyGuardian.org
  65. Admin Street: 1928 E. Highland Ave. Ste F104 PMB# 255
  66. Admin City: Phoenix
  67. Admin State/Province: AZ
  68. Admin Postal Code: 85016
  69. Admin Country: US
  70. Admin Phone: +1.3478717726
  71. Admin Phone Ext:
  72. Admin Fax:
  73. Admin Fax Ext:
  74. Admin Email: pw-7b1809281f339bb93978dfeec6d6210a@privacyguardian.org
  75. Registry Tech ID:
  76. Tech Name: Domain Administrator
  77. Tech Organization: See PrivacyGuardian.org
  78. Tech Street: 1928 E. Highland Ave. Ste F104 PMB# 255
  79. Tech City: Phoenix
  80. Tech State/Province: AZ
  81. Tech Postal Code: 85016
  82. Tech Country: US
  83. Tech Phone: +1.3478717726
  84. Tech Phone Ext:
  85. Tech Fax:
  86. Tech Fax Ext:
  87. Tech Email: pw-7b1809281f339bb93978dfeec6d6210a@privacyguardian.org
  88. Name Server: ns1.s11.fcomet.com
  89. Name Server: ns2.s11.fcomet.com
  90. DNSSEC: unsigned
  91. ######################################################################################################################################
  92.  
  93. [+] Target : tlwen.com
  94.  
  95. [+] IP Address : 184.154.7.82
  96.  
  97. [+] Headers :
  98.  
  99. [+] Date : Tue, 19 Nov 2019 21:16:59 GMT
  100. [+] Server : Apache
  101. [+] X-Powered-By : PHP/5.6.40
  102. [+] Cache-Control : private
  103. [+] Pragma : private
  104. [+] X-UA-Compatible : IE=7
  105. [+] Content-Encoding : gzip
  106. [+] Set-Cookie : bbsessionhash=0d5c007ea53f4953c4f95329825444be; path=/forums/; HttpOnly, bblastvisit=1574198219; expires=Wed, 18-Nov-2020 21:16:59 GMT; Max-Age=31536000; path=/forums/; secure, bblastactivity=0; expires=Wed, 18-Nov-2020 21:16:59 GMT; Max-Age=31536000; path=/forums/; secure
  107. [+] Upgrade : h2,h2c
  108. [+] Connection : Upgrade, Keep-Alive
  109. [+] Accept-Ranges : none
  110. [+] Vary : User-Agent
  111. [+] Keep-Alive : timeout=5, max=100
  112. [+] Transfer-Encoding : chunked
  113. [+] Content-Type : text/html; charset=UTF-8
  114.  
  115. [+] SSL Certificate Information :
  116.  
  117. [+] commonName : tlwen.com
  118. [+] countryName : US
  119. [+] organizationName : Let's Encrypt
  120. [+] commonName : Let's Encrypt Authority X3
  121. [+] Version : 3
  122. [+] Serial Number : 0368326E6F97E66BB0A86A62830E44E2578F
  123. [+] Not Before : Oct  6 00:20:32 2019 GMT
  124. [+] Not After : Jan  4 00:20:32 2020 GMT
  125. [+] OCSP : ('http://ocsp.int-x3.letsencrypt.org',)
  126. [+] subject Alt Name : (('DNS', 'tlwen.com'), ('DNS', 'www.tlwen.com'))
  127. [+] CA Issuers : ('http://cert.int-x3.letsencrypt.org/',)
  128.  
  129. [+] Whois Lookup :
  130.  
  131. [+] NIR : None
  132. [+] ASN Registry : arin
  133. [+] ASN : 32475
  134. [+] ASN CIDR : 184.154.0.0/16
  135. [+] ASN Country Code : US
  136. [+] ASN Date : 2010-06-21
  137. [+] ASN Description : SINGLEHOP-LLC - SingleHop LLC, US
  138. [+] cidr : 184.154.0.0/16
  139. [+] name : SINGLEHOP
  140. [+] handle : NET-184-154-0-0-1
  141. [+] range : 184.154.0.0 - 184.154.255.255
  142. [+] description : SingleHop LLC
  143. [+] country : US
  144. [+] state : IL
  145. [+] city : Chicago
  146. [+] address : 230 S. Clark St.
  147. PO Box 415
  148. [+] postal_code : 60604
  149. [+] emails : ['netops@singlehop.com']
  150. [+] created : 2010-06-21
  151. [+] updated : 2018-02-27
  152.  
  153. [+] Crawling Target...
  154.  
  155. [+] Looking for robots.txt........[ Found ]
  156. [+] Extracting robots Links.......[ 23 ]
  157. [+] Looking for sitemap.xml.......[ Not Found ]
  158. [+] Extracting CSS Links..........[ 2 ]
  159. [+] Extracting Javascript Links...[ 7 ]
  160. [+] Extracting Internal Links.....[ 1 ]
  161. [+] Extracting External Links.....[ 0 ]
  162. [+] Extracting Images.............[ 9 ]
  163.  
  164. [+] Total Links Extracted : 42
  165.  
  166. [+] Dumping Links in /opt/FinalRecon/dumps/tlwen.com.dump
  167. [+] Completed!
  168. #####################################################################################################################################
  169. [i] Scanning Site: https://tlwen.com
  170.  
  171.  
  172.  
  173. B A S I C   I N F O
  174. ====================
  175.  
  176.  
  177. [+] Site Title: منتديات تلوين
  178. [+] IP address: 184.154.7.82
  179. [+] Web Server: Apache
  180. [+] CMS: Could Not Detect
  181. [+] Cloudflare: Not Detected
  182. [+] Robots File: Found
  183.  
  184. -------------[ contents ]----------------  
  185. User-agent: *
  186. Disallow: /forums/announcement.php
  187. Disallow: /forums/cron.php
  188. Disallow: /forums/editpost.php
  189. Disallow: /forums/joinrequests.php
  190. Disallow: /forums/login.php
  191. Disallow: /forums/misc.php
  192. Disallow: /forums/moderator.php
  193. Disallow: /forums/newreply.php
  194. Disallow: /forums/newthread.php
  195. Disallow: /forums/online.php
  196. Disallow: /forums/private.php
  197. Disallow: /forums/profile.php
  198. Disallow: /forums/register.php
  199. Disallow: /forums/search.php
  200. Disallow: /forums/sendmessage.php
  201. Disallow: /forums/showgroups.php
  202. Disallow: /forums/showpost.php
  203. Disallow: /forums/subscription.php
  204. Disallow: /forums/threadrate.php
  205. Disallow: /forums/usercp.php
  206. Disallow: /forums/payments.php
  207. Disallow: /forums/memberlist.php
  208. Disallow: /forums/image.php
  209.  
  210. https://tlwen.com/forums/xmlsitemap.php
  211.  
  212. -----------[end of contents]-------------
  213.  
  214.  
  215.  
  216. W H O I S   L O O K U P
  217. ========================
  218.  
  219.        Domain Name: TLWEN.COM
  220.    Registry Domain ID: 2039148583_DOMAIN_COM-VRSN
  221.    Registrar WHOIS Server: whois.namesilo.com
  222.    Registrar URL: http://www.namesilo.com
  223.    Updated Date: 2018-03-02T02:14:29Z
  224.    Creation Date: 2016-07-01T22:33:01Z
  225.    Registry Expiry Date: 2022-07-01T22:33:01Z
  226.    Registrar: NameSilo, LLC
  227.    Registrar IANA ID: 1479
  228.    Registrar Abuse Contact Email: abuse@namesilo.com
  229.    Registrar Abuse Contact Phone: +1.4805240066
  230.    Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
  231.    Name Server: NS1.S11.FCOMET.COM
  232.    Name Server: NS2.S11.FCOMET.COM
  233.    DNSSEC: unsigned
  234.    URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
  235. >>> Last update of whois database: 2019-11-19T21:17:13Z <<<
  236.  
  237. For more information on Whois status codes, please visit https://icann.org/epp
  238.  
  239.  
  240.  
  241. The Registry database contains ONLY .COM, .NET, .EDU domains and
  242. Registrars.
  243.  
  244.  
  245.  
  246.  
  247. G E O  I P  L O O K  U P
  248. =========================
  249.  
  250. [i] IP Address: 184.154.7.82
  251. [i] Country: United States
  252. [i] State: Illinois
  253. [i] City: Chicago
  254. [i] Latitude: 41.8777
  255. [i] Longitude: -87.6376
  256.  
  257.  
  258.  
  259.  
  260. H T T P   H E A D E R S
  261. =======================
  262.  
  263.  
  264. [i]  HTTP/1.1 302 Found
  265. [i]  Date: Tue, 19 Nov 2019 21:17:27 GMT
  266. [i]  Server: Apache
  267. [i]  Location: http://tlwen.com/forums/
  268. [i]  Content-Length: 208
  269. [i]  Connection: close
  270. [i]  Content-Type: text/html; charset=iso-8859-1
  271. [i]  HTTP/1.1 301 Moved Permanently
  272. [i]  Date: Tue, 19 Nov 2019 21:17:28 GMT
  273. [i]  Server: Apache
  274. [i]  Location: https://tlwen.com/forums/
  275. [i]  Content-Length: 233
  276. [i]  Connection: close
  277. [i]  Content-Type: text/html; charset=iso-8859-1
  278. [i]  HTTP/1.1 200 OK
  279. [i]  Date: Tue, 19 Nov 2019 21:17:29 GMT
  280. [i]  Server: Apache
  281. [i]  X-Powered-By: PHP/5.6.40
  282. [i]  Cache-Control: private
  283. [i]  Pragma: private
  284. [i]  X-UA-Compatible: IE=7
  285. [i]  Set-Cookie: bblastvisit=1574198249; expires=Wed, 18-Nov-2020 21:17:29 GMT; Max-Age=31536000; path=/forums/; secure
  286. [i]  Set-Cookie: bblastactivity=0; expires=Wed, 18-Nov-2020 21:17:29 GMT; Max-Age=31536000; path=/forums/; secure
  287. [i]  Upgrade: h2,h2c
  288. [i]  Connection: Upgrade, close
  289. [i]  Vary: Accept-Encoding,User-Agent
  290. [i]  Content-Type: text/html; charset=UTF-8
  291.  
  292.  
  293.  
  294.  
  295. D N S   L O O K U P
  296. ===================
  297.  
  298. tlwen.com.      14399   IN  TXT "v=spf1 a:5817.submission.antispamcloud.com a:release.antispamcloud.com -all"
  299. tlwen.com.      3599    IN  MX  10 s11.fcomet.com.
  300. tlwen.com.      21599   IN  SOA ns1.s11.fcomet.com. root.s11.fcomet.com. 2018122905 3600 7200 1209600 86400
  301. tlwen.com.      21599   IN  NS  ns2.s11.fcomet.com.
  302. tlwen.com.      21599   IN  NS  ns1.s11.fcomet.com.
  303. tlwen.com.      14399   IN  A   184.154.7.82
  304.  
  305.  
  306.  
  307.  
  308. S U B N E T   C A L C U L A T I O N
  309. ====================================
  310.  
  311. Address       = 184.154.7.82
  312. Network       = 184.154.7.82 / 32
  313. Netmask       = 255.255.255.255
  314. Broadcast     = not needed on Point-to-Point links
  315. Wildcard Mask = 0.0.0.0
  316. Hosts Bits    = 0
  317. Max. Hosts    = 1   (2^0 - 0)
  318. Host Range    = { 184.154.7.82 - 184.154.7.82 }
  319.  
  320.  
  321.  
  322. N M A P   P O R T   S C A N
  323. ============================
  324.  
  325. Starting Nmap 7.70 ( https://nmap.org ) at 2019-11-19 21:17 UTC
  326. Nmap scan report for tlwen.com (184.154.7.82)
  327. Host is up (0.018s latency).
  328. rDNS record for 184.154.7.82: s11.fcomet.com
  329.  
  330. PORT     STATE    SERVICE
  331. 21/tcp   open     ftp
  332. 22/tcp   filtered ssh
  333. 23/tcp   filtered telnet
  334. 80/tcp   open     http
  335. 110/tcp  filtered pop3
  336. 143/tcp  filtered imap
  337. 443/tcp  filtered https
  338. 3389/tcp filtered ms-wbt-server
  339.  
  340. Nmap done: 1 IP address (1 host up) scanned in 2.15 seconds
  341.  
  342.  
  343.  
  344. S U B - D O M A I N   F I N D E R
  345. ==================================
  346.  
  347.  
  348. [i] Total Subdomains Found : 11
  349.  
  350. [+] Subdomain: www.tlwen.tlwen.com
  351. [-] IP: 184.154.7.82
  352.  
  353. [+] Subdomain: naser.tlwen.com
  354. [-] IP: 184.154.7.82
  355.  
  356. [+] Subdomain: www.naser.tlwen.com
  357. [-] IP: 184.154.7.82
  358.  
  359. [+] Subdomain: dir.tlwen.com
  360. [-] IP: 184.154.7.82
  361.  
  362. [+] Subdomain: www.dir.tlwen.com
  363. [-] IP: 184.154.7.82
  364.  
  365. [+] Subdomain: rabt.tlwen.com
  366. [-] IP: 184.154.7.82
  367.  
  368. [+] Subdomain: www.rabt.tlwen.com
  369. [-] IP: 184.154.7.82
  370.  
  371. [+] Subdomain: alrwabt.tlwen.com
  372. [-] IP: 184.154.7.82
  373.  
  374. [+] Subdomain: www.alrwabt.tlwen.com
  375. [-] IP: 184.154.7.82
  376.  
  377. [+] Subdomain: azoz.tlwen.com
  378. [-] IP: 184.154.7.82
  379.  
  380. [+] Subdomain: www.azoz.tlwen.com
  381. [-] IP: 184.154.7.82
  382. #######################################################################################################################################
  383. [+] Starting At 2019-11-19 16:17:43.546401
  384. [+] Collecting Information On: https://tlwen.com/forums/
  385. [#] Status: 200
  386. --------------------------------------------------
  387. [#] Web Server Detected: Apache
  388. [#] X-Powered-By: PHP/5.6.40
  389. [!] X-Frame-Options Headers not detect! target might be vulnerable Click Jacking
  390. - Date: Tue, 19 Nov 2019 21:17:43 GMT
  391. - Server: Apache
  392. - X-Powered-By: PHP/5.6.40
  393. - Cache-Control: private
  394. - Pragma: private
  395. - X-UA-Compatible: IE=7
  396. - Content-Encoding: gzip
  397. - Set-Cookie: bbsessionhash=be0a4b5ba5cefea775acf8866b15c1f9; path=/forums/; HttpOnly, bblastvisit=1574198263; expires=Wed, 18-Nov-2020 21:17:43 GMT; Max-Age=31536000; path=/forums/; secure, bblastactivity=0; expires=Wed, 18-Nov-2020 21:17:43 GMT; Max-Age=31536000; path=/forums/; secure
  398. - Upgrade: h2,h2c
  399. - Connection: Upgrade, Keep-Alive
  400. - Accept-Ranges: none
  401. - Vary: User-Agent
  402. - Keep-Alive: timeout=5, max=100
  403. - Transfer-Encoding: chunked
  404. - Content-Type: text/html; charset=UTF-8
  405. --------------------------------------------------
  406. [#] Finding Location..!
  407. [#] status: success
  408. [#] country: United States
  409. [#] countryCode: US
  410. [#] region: IL
  411. [#] regionName: Illinois
  412. [#] city: Chicago
  413. [#] zip: 60604
  414. [#] lat: 41.8786
  415. [#] lon: -87.6311
  416. [#] timezone: America/Chicago
  417. [#] isp: SingleHop LLC
  418. [#] org: SingleHop LLC
  419. [#] as: AS32475 SingleHop LLC
  420. [#] query: 184.154.7.82
  421. --------------------------------------------------
  422. [x] Didn't Detect WAF Presence on: https://tlwen.com/forums/
  423. --------------------------------------------------
  424. [#] Starting Reverse DNS
  425. [-] Failed ! Fail
  426. --------------------------------------------------
  427. [!] Scanning Open Port
  428. [#] 21/tcp  open ftp
  429. [#] 53/tcp  open domain
  430. [#] 80/tcp  open http
  431. [#] 110/tcp  open pop3
  432. [#] 111/tcp  open rpcbind
  433. [#] 143/tcp  open imap
  434. [#] 443/tcp  open https
  435. [#] 465/tcp  open smtps
  436. [#] 587/tcp  open submission
  437. [#] 993/tcp  open imaps
  438. [#] 995/tcp  open pop3s
  439. [#] 3306/tcp  open mysql
  440. [#] 5960/tcp  open unknown
  441. --------------------------------------------------
  442. [+] Collecting Information Disclosure!
  443. [#] Detecting sitemap.xml file
  444. [-] sitemap.xml file not Found!?
  445. [#] Detecting robots.txt file
  446. [-] robots.txt file not Found!?
  447. [#] Detecting GNU Mailman
  448. [-] GNU Mailman App Not Detected!?
  449. --------------------------------------------------
  450. [+] Crawling Url Parameter On: https://tlwen.com/forums/
  451. --------------------------------------------------
  452. [#] Searching Html Form !
  453. [+] Html Form Discovered
  454. [#] action: index.php
  455. [#] class: None
  456. [#] id: None
  457. [#] method: get
  458. --------------------------------------------------
  459. [!] Found 9 dom parameter
  460. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=975#post975
  461. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1099#post1099
  462. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1131#post1131
  463. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1130#post1130
  464. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1026#post1026
  465. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1124#post1124
  466. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1123#post1123
  467. [#] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1085#post1085
  468. [#] https://tlwen.com/forums//#top
  469. --------------------------------------------------
  470. [!] 54 Internal Dynamic Parameter Discovered
  471. [+] https://tlwen.com/forums//clientscript/vbulletin_important.css?v=389
  472. [+] https://tlwen.com/forums//external.php?type=RSS2
  473. [+] https://tlwen.com/forums?s=be0a4b5ba5cefea775acf8866b15c1f9
  474. [+] https://tlwen.com/forums?s=be0a4b5ba5cefea775acf8866b15c1f9
  475. [+] https://tlwen.com/forums//register.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  476. [+] https://tlwen.com/forums//search.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;do=getdaily
  477. [+] https://tlwen.com/forums//search.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  478. [+] https://tlwen.com/forums//tags.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  479. [+] https://tlwen.com/forums//search.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  480. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=1
  481. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=2
  482. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=829
  483. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=2
  484. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=975#post975
  485. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=3
  486. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=917
  487. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=3
  488. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1099#post1099
  489. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=6
  490. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=7
  491. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=946
  492. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=6
  493. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1131#post1131
  494. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=20
  495. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=24
  496. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=954
  497. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=24
  498. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1130#post1130
  499. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=25
  500. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=874
  501. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=25
  502. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1026#post1026
  503. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=18
  504. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=26
  505. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=951
  506. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=18
  507. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1124#post1124
  508. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=4
  509. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=950
  510. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=4
  511. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1123#post1123
  512. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;f=19
  513. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;goto=newpost&amp;t=922
  514. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;find=lastposter&amp;f=19
  515. [+] https://tlwen.com/forums//showthread.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;p=1085#post1085
  516. [+] https://tlwen.com/forums//forumdisplay.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;do=markread&amp;markreadhash=guest
  517. [+] https://tlwen.com/forums//showgroups.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  518. [+] https://tlwen.com/forums//online.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  519. [+] https://tlwen.com/forums//online.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  520. [+] https://tlwen.com/forums//member.php?s=be0a4b5ba5cefea775acf8866b15c1f9&amp;u=294
  521. [+] https://tlwen.com/forums//external.php?type=rss2
  522. [+] https://tlwen.com/forums//external.php?type=xml
  523. [+] https://tlwen.com/forums//external.php?type=html
  524. [+] https://tlwen.com/forums//sendmessage.php?s=be0a4b5ba5cefea775acf8866b15c1f9
  525. --------------------------------------------------
  526. [-] No external Dynamic Paramter Found!?
  527. --------------------------------------------------
  528. [!] 17 Internal links Discovered
  529. [+] https://tlwen.com/forums//fontawesome/css/fontawesome-all.css
  530. [+] https://tlwen.com/forums//apple-touch-icon-57x57.png
  531. [+] https://tlwen.com/forums//apple-touch-icon-114x114.png
  532. [+] https://tlwen.com/forums//apple-touch-icon-72x72.png
  533. [+] https://tlwen.com/forums//apple-touch-icon-144x144.png
  534. [+] https://tlwen.com/forums//apple-touch-icon-60x60.png
  535. [+] https://tlwen.com/forums//apple-touch-icon-120x120.png
  536. [+] https://tlwen.com/forums//apple-touch-icon-76x76.png
  537. [+] https://tlwen.com/forums//apple-touch-icon-152x152.png
  538. [+] https://tlwen.com/forums//favicon-196x196.png
  539. [+] https://tlwen.com/forums//favicon-96x96.png
  540. [+] https://tlwen.com/forums//favicon-32x32.png
  541. [+] https://tlwen.com/forums//favicon-16x16.png
  542. [+] https://tlwen.com/forums//favicon-128.png
  543. [+] https://tlwen.com/forums//external.php
  544. [+] https://tlwen.com/forums//archive/index.php
  545. [+] https://tlwen.com/forums//archive/index.php
  546. --------------------------------------------------
  547. [-] No External Link Found!?
  548. --------------------------------------------------
  549. [#] Mapping Subdomain..
  550. [!] Found 12 Subdomain
  551. - tlwen.tlwen.com
  552. - www.tlwen.tlwen.com
  553. - naser.tlwen.com
  554. - www.naser.tlwen.com
  555. - dir.tlwen.com
  556. - www.dir.tlwen.com
  557. - rabt.tlwen.com
  558. - www.rabt.tlwen.com
  559. - alrwabt.tlwen.com
  560. - www.alrwabt.tlwen.com
  561. - azoz.tlwen.com
  562. - www.azoz.tlwen.com
  563. --------------------------------------------------
  564. [!] Done At 2019-11-19 16:18:00.269896
  565. ######################################################################################################################################
  566. [INFO] ------TARGET info------
  567. [*] TARGET: https://tlwen.com/forums/
  568. [*] TARGET IP: 184.154.7.82
  569. [INFO] NO load balancer detected for tlwen.com...
  570. [*] DNS servers: ns1.s11.fcomet.com.
  571. [*] TARGET server: Apache
  572. [*] CC: US
  573. [*] Country: United States
  574. [*] RegionCode: IL
  575. [*] RegionName: Illinois
  576. [*] City: Chicago
  577. [*] ASN: AS32475
  578. [*] BGP_PREFIX: 184.154.0.0/16
  579. [*] ISP: SINGLEHOP-LLC - SingleHop LLC, US
  580. [INFO] SSL/HTTPS certificate detected
  581. [*] Issuer: issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
  582. [*] Subject: subject=CN = tlwen.com
  583. [ALERT] Let's Encrypt is commonly used for Phishing
  584. [INFO] DNS enumeration:
  585. [*] ftp.tlwen.com    184.154.7.82
  586. [*] mail.tlwen.com   tlwen.com. 184.154.7.82
  587. [*] webmail.tlwen.com    184.154.7.82
  588. [INFO] Possible abuse mails are:
  589. [*] abuse@singlehop.com
  590. [*] abuse@tlwen.com
  591. [INFO] NO PAC (Proxy Auto Configuration) file FOUND
  592. [ALERT] robots.txt file FOUND in http://tlwen.com/robots.txt
  593. [INFO] Checking for HTTP status codes recursively from http://tlwen.com/robots.txt
  594. [INFO] Status code   Folders
  595. [*]      200         http://tlwen.com/forums/announcement.php
  596. [*]      200         http://tlwen.com/forums/cron.php
  597. [*]      200         http://tlwen.com/forums/editpost.php
  598. [*]      200         http://tlwen.com/forums/image.php
  599. [*]      200         http://tlwen.com/forums/joinrequests.php
  600. [*]      200         http://tlwen.com/forums/login.php
  601. [*]      200         http://tlwen.com/forums/memberlist.php
  602. [*]      200         http://tlwen.com/forums/misc.php
  603. [*]      200         http://tlwen.com/forums/moderator.php
  604. [*]      200         http://tlwen.com/forums/newreply.php
  605. [*]      200         http://tlwen.com/forums/newthread.php
  606. [*]      200         http://tlwen.com/forums/online.php
  607. [*]      200         http://tlwen.com/forums/payments.php
  608. [*]      200         http://tlwen.com/forums/private.php
  609. [*]      200         http://tlwen.com/forums/profile.php
  610. [*]      200         http://tlwen.com/forums/register.php
  611. [*]      200         http://tlwen.com/forums/search.php
  612. [*]      200         http://tlwen.com/forums/sendmessage.php
  613. [*]      200         http://tlwen.com/forums/showgroups.php
  614. [*]      200         http://tlwen.com/forums/showpost.php
  615. [*]      200         http://tlwen.com/forums/subscription.php
  616. [*]      200         http://tlwen.com/forums/threadrate.php
  617. [*]      200         http://tlwen.com/forums/usercp.php
  618. [INFO] Starting FUZZing in http://tlwen.com/FUzZzZzZzZz...
  619. [INFO] Status code   Folders
  620. [ALERT] Look in the source code. It may contain passwords
  621. [ALERT] Content in http://tlwen.com/ AND http://www.tlwen.com/ is different
  622. [INFO] MD5 for http://tlwen.com/ is: 5c256bc6a58018f2cecc240e66ab7db4
  623. [INFO] MD5 for http://www.tlwen.com/ is: a46d958fdd9cad947816279fe5302017
  624. [INFO] http://tlwen.com/ redirects to https://tlwen.com/forums/
  625. [INFO] http://www.tlwen.com/ redirects to https://tlwen.com/forums/
  626. [INFO] Links found from https://tlwen.com/forums/ http://184.154.7.82/:
  627. [*] http://184.154.7.82/cgi-sys/defaultwebpage.cgi
  628. [*] https://tlwen.com/forums/archive/index.php
  629. [*] https://tlwen.com/forums/external.php
  630. [*] https://tlwen.com/forums/external.php?type=html
  631. [*] https://tlwen.com/forums/external.php?type=RSS2
  632. [*] https://tlwen.com/forums/external.php?type=rss2
  633. [*] https://tlwen.com/forums/external.php?type=xml
  634. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&do=markread&markreadhash=guest
  635. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=1
  636. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=18
  637. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=19
  638. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=2
  639. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=20
  640. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=24
  641. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=25
  642. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=26
  643. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=3
  644. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=4
  645. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=6
  646. [*] https://tlwen.com/forums/forumdisplay.php?s=0010e5d7c0c1b8c4afe6eae70739593c&f=7
  647. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=18
  648. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=19
  649. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=2
  650. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=24
  651. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=25
  652. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=3
  653. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=4
  654. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&find=lastposter&f=6
  655. [*] https://tlwen.com/forums/member.php?s=0010e5d7c0c1b8c4afe6eae70739593c&u=294
  656. [*] https://tlwen.com/forums/online.php?s=0010e5d7c0c1b8c4afe6eae70739593c
  657. [*] https://tlwen.com/forums/register.php?s=0010e5d7c0c1b8c4afe6eae70739593c
  658. [*] https://tlwen.com/forums?s=0010e5d7c0c1b8c4afe6eae70739593c
  659. [*] https://tlwen.com/forums/search.php?s=0010e5d7c0c1b8c4afe6eae70739593c
  660. [*] https://tlwen.com/forums/search.php?s=0010e5d7c0c1b8c4afe6eae70739593c&do=getdaily
  661. [*] https://tlwen.com/forums/sendmessage.php?s=0010e5d7c0c1b8c4afe6eae70739593c
  662. [*] https://tlwen.com/forums/showgroups.php?s=0010e5d7c0c1b8c4afe6eae70739593c
  663. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=829
  664. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=874
  665. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=917
  666. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=922
  667. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=946
  668. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=950
  669. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=951
  670. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&goto=newpost&t=954
  671. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1026#post1026
  672. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1085#post1085
  673. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1099#post1099
  674. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1123#post1123
  675. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1124#post1124
  676. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1130#post1130
  677. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=1131#post1131
  678. [*] https://tlwen.com/forums/showthread.php?s=0010e5d7c0c1b8c4afe6eae70739593c&p=975#post975
  679. [*] https://tlwen.com/forums/#top
  680. cut: intervalle de champ incorrecte
  681. Saisissez « cut --help » pour plus d'informations.
  682. [INFO] BING shows 184.154.7.82 is shared with 21,300 hosts/vhosts
  683. [INFO] Shodan detected the following opened ports on 184.154.7.82:
  684. [INFO] ------VirusTotal SECTION------
  685. [INFO] VirusTotal passive DNS only stores address records. The following domains resolved to the given IP address:
  686. [INFO] Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset:
  687. [INFO] Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided:
  688. [INFO] ------Alexa Rank SECTION------
  689. [INFO] Percent of Visitors Rank in Country:
  690. [INFO] Percent of Search Traffic:
  691. [INFO] Percent of Unique Visits:
  692. [INFO] Total Sites Linking In:
  693. [*] Total  Sites
  694. [INFO] Useful links related to tlwen.com - 184.154.7.82:
  695. [*] https://www.virustotal.com/pt/ip-address/184.154.7.82/information/
  696. [*] https://www.hybrid-analysis.com/search?host=184.154.7.82
  697. [*] https://www.shodan.io/host/184.154.7.82
  698. [*] https://www.senderbase.org/lookup/?search_string=184.154.7.82
  699. [*] https://www.alienvault.com/open-threat-exchange/ip/184.154.7.82
  700. [*] http://pastebin.com/search?q=184.154.7.82
  701. [*] http://urlquery.net/search.php?q=184.154.7.82
  702. [*] http://www.alexa.com/siteinfo/tlwen.com
  703. [*] http://www.google.com/safebrowsing/diagnostic?site=tlwen.com
  704. [*] https://censys.io/ipv4/184.154.7.82
  705. [*] https://www.abuseipdb.com/check/184.154.7.82
  706. [*] https://urlscan.io/search/#184.154.7.82
  707. [*] https://github.com/search?q=184.154.7.82&type=Code
  708. [INFO] Useful links related to AS32475 - 184.154.0.0/16:
  709. [*] http://www.google.com/safebrowsing/diagnostic?site=AS:32475
  710. [*] https://www.senderbase.org/lookup/?search_string=184.154.0.0/16
  711. [*] http://bgp.he.net/AS32475
  712. [*] https://stat.ripe.net/AS32475
  713. [INFO] Date: 19/11/19 | Time: 16:20:30
  714. [INFO] Total time: 2 minute(s) and 45 second(s)
  715. ######################################################################################################################################
  716. Trying "tlwen.com"
  717. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57359
  718. ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 2, ADDITIONAL: 2
  719.  
  720. ;; QUESTION SECTION:
  721. ;tlwen.com.         IN  ANY
  722.  
  723. ;; ANSWER SECTION:
  724. tlwen.com.      14400   IN  A   184.154.7.82
  725. tlwen.com.      43200   IN  SOA ns1.s11.fcomet.com. root.s11.fcomet.com. 2018122905 3600 7200 1209600 86400
  726. tlwen.com.      3600    IN  MX  10 s11.fcomet.com.
  727. tlwen.com.      14400   IN  TXT "v=spf1 a:5817.submission.antispamcloud.com a:release.antispamcloud.com -all"
  728. tlwen.com.      43200   IN  NS  ns2.s11.fcomet.com.
  729. tlwen.com.      43200   IN  NS  ns1.s11.fcomet.com.
  730.  
  731. ;; AUTHORITY SECTION:
  732. tlwen.com.      43200   IN  NS  ns2.s11.fcomet.com.
  733. tlwen.com.      43200   IN  NS  ns1.s11.fcomet.com.
  734.  
  735. ;; ADDITIONAL SECTION:
  736. ns2.s11.fcomet.com. 43200   IN  A   184.154.7.83
  737. ns1.s11.fcomet.com. 43200   IN  A   184.154.7.82
  738.  
  739. Received 295 bytes from 2001:18c0:121:6900:724f:b8ff:fefd:5b6a#53 in 85 ms
  740. #######################################################################################################################################
  741. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> +trace tlwen.com any
  742. ;; global options: +cmd
  743. .           82437   IN  NS  a.root-servers.net.
  744. .           82437   IN  NS  f.root-servers.net.
  745. .           82437   IN  NS  j.root-servers.net.
  746. .           82437   IN  NS  c.root-servers.net.
  747. .           82437   IN  NS  k.root-servers.net.
  748. .           82437   IN  NS  m.root-servers.net.
  749. .           82437   IN  NS  h.root-servers.net.
  750. .           82437   IN  NS  b.root-servers.net.
  751. .           82437   IN  NS  i.root-servers.net.
  752. .           82437   IN  NS  d.root-servers.net.
  753. .           82437   IN  NS  l.root-servers.net.
  754. .           82437   IN  NS  e.root-servers.net.
  755. .           82437   IN  NS  g.root-servers.net.
  756. .           82437   IN  RRSIG   NS 8 0 518400 20191202170000 20191119160000 22545 . U4n0oPMRLLShMS7p/I/nPhGFF9AJFtoidxyVC/D9QSFa6aQnRnWnJx1+ OQKnZvr+CsRiBvk4viiXdccM9dHsb5JalMMrJfUpVdDlcNyB89VAPy10 Pg6jkVI1YkwXE/eAjHp0kpA9+vyk+RsO8b8XzBMa6Wd6KHHsNs2NflT3 g9cMQNKhttKihAMWY71h6XC8pa0Czo1BsZHhtWEBfuULyImfbPcjVNEO Bxl75VdHTSByR6G/CWrl4AwGDC7Gt+SKw8ydDPtKMDOlpluxnZkvGSWs xv/5jv6hkEipc0ha/nFxgSfUmODuKkaBXIw2gPcZBIQv1rdhKhlzli74 JKxeXw==
  757. ;; Received 525 bytes from 185.93.180.131#53(185.93.180.131) in 159 ms
  758.  
  759. com.            172800  IN  NS  l.gtld-servers.net.
  760. com.            172800  IN  NS  d.gtld-servers.net.
  761. com.            172800  IN  NS  e.gtld-servers.net.
  762. com.            172800  IN  NS  m.gtld-servers.net.
  763. com.            172800  IN  NS  k.gtld-servers.net.
  764. com.            172800  IN  NS  a.gtld-servers.net.
  765. com.            172800  IN  NS  g.gtld-servers.net.
  766. com.            172800  IN  NS  c.gtld-servers.net.
  767. com.            172800  IN  NS  h.gtld-servers.net.
  768. com.            172800  IN  NS  j.gtld-servers.net.
  769. com.            172800  IN  NS  b.gtld-servers.net.
  770. com.            172800  IN  NS  i.gtld-servers.net.
  771. com.            172800  IN  NS  f.gtld-servers.net.
  772. com.            86400   IN  DS  30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
  773. com.            86400   IN  RRSIG   DS 8 1 86400 20191202210000 20191119200000 22545 . bZjTiIGWGq67jpDjXdecZ272HAYsUGZmGS2LD/4et+bU+1MyxDrwldQl J4/E0RmFMX76mTiVEU4/nxwtKOI9ez4D1O2aHweGjQ8E/o75O4rhCkc6 7VCV4OElMK6YLhndkr6xiLgQT2pqAzE0PEG2DX1HtXR6SpehhgLMZL1r BJoIK0aZqROGeqpZwUVLIB9WeuLQWTSb1/KZQaRzKdebsQcHiLy78zcf 5cHeEGwtp7sAS3EfpLDi5QBpcUN0KgbMhrYOv9aVTUMzON9w5iUgRqh/ ZN0wsVorZHI1+Udz1iNg9/ui/xmucVkQRgyTEdZRXUvcnMDmpt21Sj0y X4A2/g==
  774. ;; Received 1169 bytes from 192.36.148.17#53(i.root-servers.net) in 311 ms
  775.  
  776. tlwen.com.      172800  IN  NS  ns1.s11.fcomet.com.
  777. tlwen.com.      172800  IN  NS  ns2.s11.fcomet.com.
  778. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
  779. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20191123054728 20191116043728 12163 com. btzdeUtSLcARM7/OwJcRBpEqW53aWhYA3fHkIvtFPvkcIcmtbp09p8G4 ABw1OgCoJnyPb0AkHQlCjiAaA97BEqcOPfp8DKZDaF2LKd527gX0CDaH cUk9gOaFL9bg4o6mjK4ltAaBRgSgvrILyaOT1FX3l4P6+7DtZ30wshIh bflBZVHfwlaW0rBErWHkAhhkfw+mAOSCWuXIvfSjpMcLwg==
  780. R5QTA0ILKG6L7O9Q68E7S3RITC5KR8K8.com. 86400 IN NSEC3 1 1 0 - R5QV5C90CV1JE892J0IK68H7AQ7GOL3J NS DS RRSIG
  781. R5QTA0ILKG6L7O9Q68E7S3RITC5KR8K8.com. 86400 IN RRSIG NSEC3 8 2 86400 20191124062830 20191117051830 12163 com. DtrKT5tU3p5HNh4z3C97F0ht/6IaonOhN1u1yw3gtEYrdKov04iMtoZL f85dx29KNtLy8AA/igyIGPG8+sFDwFGr+zv0C5UuI7nVuYoCwUo+jYtw Ia2J0peVN4/PZTNJWAMDwxbwARee2ssvTnDYhpuZsN18zN5KOlpkfBpe rLBZu4DjcYripfG42ePldk0GaBn3JtAcXtteehvO0LqwPg==
  782. ;; Received 666 bytes from 2001:503:d414::30#53(f.gtld-servers.net) in 101 ms
  783.  
  784. tlwen.com.      14400   IN  TXT "v=spf1 a:5817.submission.antispamcloud.com a:release.antispamcloud.com -all"
  785. tlwen.com.      3600    IN  MX  10 s11.fcomet.com.
  786. tlwen.com.      86400   IN  SOA ns1.s11.fcomet.com. root.s11.fcomet.com. 2018122905 3600 7200 1209600 86400
  787. tlwen.com.      86400   IN  NS  ns2.s11.fcomet.com.
  788. tlwen.com.      86400   IN  NS  ns1.s11.fcomet.com.
  789. tlwen.com.      14400   IN  A   184.154.7.82
  790. ;; Received 278 bytes from 184.154.7.82#53(ns1.s11.fcomet.com) in 262 ms
  791. ######################################################################################################################################
  792. [*] Performing General Enumeration of Domain: tlwen.com
  793. [-] DNSSEC is not configured for tlwen.com
  794. [*]      SOA ns1.s11.fcomet.com 184.154.7.82
  795. [*]      NS ns2.s11.fcomet.com 184.154.7.83
  796. [*]      NS ns1.s11.fcomet.com 184.154.7.82
  797. [*]      Bind Version for 184.154.7.82 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3
  798. [*]      MX s11.fcomet.com 184.154.7.82
  799. [*]      A tlwen.com 184.154.7.82
  800. [*]      TXT tlwen.com v=spf1 a:5817.submission.antispamcloud.com a:release.antispamcloud.com -all
  801. [*] Enumerating SRV Records
  802. [-] No SRV Records Found for tlwen.com
  803. [+] 0 Records Found
  804. ######################################################################################################################################
  805. [*] Processing domain tlwen.com
  806. [*] Using system resolvers ['185.93.180.131', '194.187.251.67', '38.132.106.139', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  807. [+] Getting nameservers
  808. 184.154.7.83 - ns2.s11.fcomet.com
  809. 184.154.7.82 - ns1.s11.fcomet.com
  810. [-] Zone transfer failed
  811.  
  812. [+] TXT records found
  813. "v=spf1 a:5817.submission.antispamcloud.com a:release.antispamcloud.com -all"
  814.  
  815. [+] MX records found, added to target list
  816. 10 s11.fcomet.com.
  817.  
  818. [*] Scanning tlwen.com for A records
  819. 184.154.7.82 - tlwen.com                          
  820. 184.154.7.82 - cpanel.tlwen.com                              
  821. 184.154.7.82 - ftp.tlwen.com                                  
  822. 184.154.7.82 - mail.tlwen.com                      
  823. 184.154.7.82 - webdisk.tlwen.com                      
  824. 184.154.7.82 - webmail.tlwen.com                  
  825. 184.154.7.82 - whm.tlwen.com                    
  826. 184.154.7.82 - www.tlwen.com  
  827. ######################################################################################################################################
  828.  AVAILABLE PLUGINS
  829.  -----------------
  830.  
  831.   EarlyDataPlugin
  832.   FallbackScsvPlugin
  833.   HeartbleedPlugin
  834.   CertificateInfoPlugin
  835.   OpenSslCipherSuitesPlugin
  836.   RobotPlugin
  837.   CompressionPlugin
  838.   SessionResumptionPlugin
  839.   OpenSslCcsInjectionPlugin
  840.   SessionRenegotiationPlugin
  841.   HttpHeadersPlugin
  842.  
  843.  
  844.  
  845.  CHECKING HOST(S) AVAILABILITY
  846.  -----------------------------
  847.  
  848.    184.154.7.82:443                       => 184.154.7.82
  849.  
  850.  
  851.  
  852.  
  853.  SCAN RESULTS FOR 184.154.7.82:443 - 184.154.7.82
  854.  ------------------------------------------------
  855.  
  856.  * Downgrade Attacks:
  857.        TLS_FALLBACK_SCSV:                 OK - Supported
  858.  
  859.  * SSLV2 Cipher Suites:
  860.       Server rejected all cipher suites.
  861.  
  862.  * TLSV1_3 Cipher Suites:
  863.       Server rejected all cipher suites.
  864.  
  865.  * Certificate Information:
  866.      Content
  867.        SHA1 Fingerprint:                  ea19ffdcbe5650d2e0d55cb2ea5132c4fc7baec8
  868.        Common Name:                       nossl.s11.fcomet.com
  869.        Issuer:                            Let's Encrypt Authority X3
  870.        Serial Number:                     359737361736392758321764430293030633336692
  871.        Not Before:                        2019-09-26 12:28:23
  872.        Not After:                         2019-12-25 12:28:23
  873.        Signature Algorithm:               sha256
  874.        Public Key Algorithm:              RSA
  875.        Key Size:                          2048
  876.        Exponent:                          65537 (0x10001)
  877.        DNS Subject Alternative Names:     ['nossl.s11.fcomet.com']
  878.  
  879.      Trust
  880.        Hostname Validation:               FAILED - Certificate does NOT match 184.154.7.82
  881.        Android CA Store (9.0.0_r9):       OK - Certificate is trusted
  882.        Apple CA Store (iOS 12, macOS 10.14, watchOS 5, and tvOS 12):OK - Certificate is trusted
  883.        Java CA Store (jdk-12.0.1):        OK - Certificate is trusted
  884.        Mozilla CA Store (2019-03-14):     OK - Certificate is trusted
  885.        Windows CA Store (2019-05-27):     OK - Certificate is trusted
  886.        Symantec 2018 Deprecation:         WARNING: Certificate distrusted by Google and Mozilla on September 2018
  887.        Received Chain:                    nossl.s11.fcomet.com --> Let's Encrypt Authority X3
  888.        Verified Chain:                    nossl.s11.fcomet.com --> Let's Encrypt Authority X3 --> DST Root CA X3
  889.        Received Chain Contains Anchor:    OK - Anchor certificate not sent
  890.        Received Chain Order:              OK - Order is valid
  891.        Verified Chain contains SHA1:      OK - No SHA1-signed certificate in the verified certificate chain
  892.  
  893.      Extensions
  894.        OCSP Must-Staple:                  NOT SUPPORTED - Extension not found
  895.        Certificate Transparency:          WARNING - Only 2 SCTs included but Google recommends 3 or more
  896.  
  897.      OCSP Stapling
  898.        OCSP Response Status:              successful
  899.        Validation w/ Mozilla Store:       OK - Response is trusted
  900.        Responder Id:                      C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
  901.        Cert Status:                       good
  902.        Cert Serial Number:                04212C4FB55307A539F67CBA9C7EF349EF74
  903.        This Update:                       Nov 16 13:00:00 2019 GMT
  904.        Next Update:                       Nov 23 13:00:00 2019 GMT
  905.  
  906.  * OpenSSL Heartbleed:
  907.                                           OK - Not vulnerable to Heartbleed
  908.  
  909.  * TLSV1_2 Cipher Suites:
  910.        Forward Secrecy                    OK - Supported
  911.        RC4                                OK - Not Supported
  912.  
  913.      Preferred:
  914.         TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384                            256 bits      HTTP 200 OK                                                
  915.      Accepted:
  916.         TLS_RSA_WITH_AES_256_GCM_SHA384                                  256 bits      HTTP 200 OK                                                
  917.         TLS_RSA_WITH_AES_256_CBC_SHA256                                  256 bits      HTTP 200 OK                                                
  918.         TLS_RSA_WITH_AES_256_CBC_SHA                                     256 bits      HTTP 200 OK                                                
  919.         TLS_RSA_WITH_AES_128_GCM_SHA256                                  128 bits      HTTP 200 OK                                                
  920.         TLS_RSA_WITH_AES_128_CBC_SHA256                                  128 bits      HTTP 200 OK                                                
  921.         TLS_RSA_WITH_AES_128_CBC_SHA                                     128 bits      HTTP 200 OK                                                
  922.         TLS_RSA_WITH_3DES_EDE_CBC_SHA                                    112 bits      HTTP 200 OK                                                
  923.         TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384                            256 bits      HTTP 200 OK                                                
  924.         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384                            256 bits      HTTP 200 OK                                                
  925.         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                               256 bits      HTTP 200 OK                                                
  926.         TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256                            128 bits      HTTP 200 OK                                                
  927.         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256                            128 bits      HTTP 200 OK                                                
  928.         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                               128 bits      HTTP 200 OK                                                
  929.         TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA                              112 bits      HTTP 200 OK                                                
  930.         TLS_DHE_RSA_WITH_AES_256_GCM_SHA384                              256 bits      HTTP 200 OK                                                
  931.         TLS_DHE_RSA_WITH_AES_256_CBC_SHA256                              256 bits      HTTP 200 OK                                                
  932.         TLS_DHE_RSA_WITH_AES_256_CBC_SHA                                 256 bits      HTTP 200 OK                                                
  933.         TLS_DHE_RSA_WITH_AES_128_GCM_SHA256                              128 bits      HTTP 200 OK                                                
  934.         TLS_DHE_RSA_WITH_AES_128_CBC_SHA256                              128 bits      HTTP 200 OK                                                
  935.         TLS_DHE_RSA_WITH_AES_128_CBC_SHA                                 128 bits      HTTP 200 OK                                                
  936.         TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA                                112 bits      HTTP 200 OK                                                
  937.         TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA                                112 bits      HTTP 200 OK                                                
  938.  
  939.  * Deflate Compression:
  940.                                           OK - Compression disabled
  941.  
  942.  * TLSV1_1 Cipher Suites:
  943.        Forward Secrecy                    OK - Supported
  944.        RC4                                OK - Not Supported
  945.  
  946.      Preferred:
  947.         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                               256 bits      HTTP 200 OK                                                
  948.      Accepted:
  949.         TLS_RSA_WITH_AES_256_CBC_SHA                                     256 bits      HTTP 200 OK                                                
  950.         TLS_RSA_WITH_AES_128_CBC_SHA                                     128 bits      HTTP 200 OK                                                
  951.         TLS_RSA_WITH_3DES_EDE_CBC_SHA                                    112 bits      HTTP 200 OK                                                
  952.         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                               256 bits      HTTP 200 OK                                                
  953.         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                               128 bits      HTTP 200 OK                                                
  954.         TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA                              112 bits      HTTP 200 OK                                                
  955.         TLS_DHE_RSA_WITH_AES_256_CBC_SHA                                 256 bits      HTTP 200 OK                                                
  956.         TLS_DHE_RSA_WITH_AES_128_CBC_SHA                                 128 bits      HTTP 200 OK                                                
  957.         TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA                                112 bits      HTTP 200 OK                                                
  958.  
  959.  * SSLV3 Cipher Suites:
  960.       Server rejected all cipher suites.
  961.  
  962.  * ROBOT Attack:
  963.                                           OK - Not vulnerable
  964.  
  965.  * TLSV1 Cipher Suites:
  966.        Forward Secrecy                    OK - Supported
  967.        RC4                                OK - Not Supported
  968.  
  969.      Preferred:
  970.         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                               256 bits      HTTP 200 OK                                                
  971.      Accepted:
  972.         TLS_RSA_WITH_AES_256_CBC_SHA                                     256 bits      HTTP 200 OK                                                
  973.         TLS_RSA_WITH_AES_128_CBC_SHA                                     128 bits      HTTP 200 OK                                                
  974.         TLS_RSA_WITH_3DES_EDE_CBC_SHA                                    112 bits      HTTP 200 OK                                                
  975.         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                               256 bits      HTTP 200 OK                                                
  976.         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                               128 bits      HTTP 200 OK                                                
  977.         TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA                              112 bits      HTTP 200 OK                                                
  978.         TLS_DHE_RSA_WITH_AES_256_CBC_SHA                                 256 bits      HTTP 200 OK                                                
  979.         TLS_DHE_RSA_WITH_AES_128_CBC_SHA                                 128 bits      HTTP 200 OK                                                
  980.         TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA                                112 bits      HTTP 200 OK                                                
  981.  
  982.  * OpenSSL CCS Injection:
  983.                                           OK - Not vulnerable to OpenSSL CCS injection
  984.  
  985.  * Session Renegotiation:
  986.        Client-initiated Renegotiation:    OK - Rejected
  987.        Secure Renegotiation:              OK - Supported
  988.  
  989.  * TLS 1.2 Session Resumption Support:
  990.       With Session IDs:                  OK - Supported (5 successful, 0 failed, 0 errors, 5 total attempts).
  991.       With TLS Tickets:                  OK - Supported
  992.  
  993.  
  994.  SCAN COMPLETED IN 26.00 S
  995.  -------------------------
  996. ######################################################################################################################################
  997. Parsero scan report for tlwen.com
  998. http://tlwen.com/forums/showpost.php 301 Moved Permanently
  999. http://tlwen.com/forums/sendmessage.php 301 Moved Permanently
  1000. http://tlwen.com/forums/profile.php 301 Moved Permanently
  1001. http://tlwen.com/forums/subscription.php 301 Moved Permanently
  1002. http://tlwen.com/forums/cron.php 301 Moved Permanently
  1003. http://tlwen.com/forums/newthread.php 301 Moved Permanently
  1004. http://tlwen.com/forums/login.php 301 Moved Permanently
  1005. http://tlwen.com/forums/image.php 301 Moved Permanently
  1006. http://tlwen.com/forums/search.php 301 Moved Permanently
  1007. http://tlwen.com/forums/announcement.php 301 Moved Permanently
  1008. http://tlwen.com/forums/editpost.php 301 Moved Permanently
  1009. http://tlwen.com/forums/register.php 301 Moved Permanently
  1010. http://tlwen.com/forums/moderator.php 301 Moved Permanently
  1011. http://tlwen.com/forums/threadrate.php 301 Moved Permanently
  1012. http://tlwen.com/forums/misc.php 301 Moved Permanently
  1013. http://tlwen.com/forums/showgroups.php 301 Moved Permanently
  1014. http://tlwen.com/forums/private.php 301 Moved Permanently
  1015. http://tlwen.com/forums/memberlist.php 301 Moved Permanently
  1016. http://tlwen.com/forums/usercp.php 301 Moved Permanently
  1017. http://tlwen.com/forums/payments.php 301 Moved Permanently
  1018. http://tlwen.com/forums/online.php 301 Moved Permanently
  1019. http://tlwen.com/forums/joinrequests.php 301 Moved Permanently
  1020. http://tlwen.com/forums/newreply.php 301 Moved Permanently
  1021.  
  1022. [+] 23 links have been analyzed but any them are available...
  1023. #######################################################################################################################################
  1024.  Domains still to check: 1
  1025.     Checking if the hostname tlwen.com. given is in fact a domain...
  1026.  
  1027. Analyzing domain: tlwen.com.
  1028.     Checking NameServers using system default resolver...
  1029.         IP: 184.154.7.83 (United States)
  1030.             HostName: ns2.s11.fcomet.com            Type: NS
  1031.             HostName: s11.fcomet.com            Type: PTR
  1032.         IP: 184.154.7.82 (United States)
  1033.             HostName: ns1.s11.fcomet.com            Type: NS
  1034.             HostName: s11.fcomet.com            Type: PTR
  1035.  
  1036.     Checking MailServers using system default resolver...
  1037.         IP: 184.154.7.82 (United States)
  1038.             HostName: ns1.s11.fcomet.com            Type: NS
  1039.             HostName: s11.fcomet.com            Type: PTR
  1040.             HostName: s11.fcomet.com            Type: MX
  1041.  
  1042.     Checking the zone transfer for each NS... (if this takes more than 10 seconds, just hit CTRL-C and it will continue. Bug in the libs)
  1043.         No zone transfer found on nameserver 184.154.7.82
  1044.         No zone transfer found on nameserver 184.154.7.83
  1045.  
  1046.     Checking SPF record...
  1047.         New hostname found: 5817
  1048.         New hostname found: release
  1049.  
  1050.     Checking 194 most common hostnames using system default resolver...
  1051.         IP: 184.154.7.82 (United States)
  1052.             HostName: ns1.s11.fcomet.com            Type: NS
  1053.             HostName: s11.fcomet.com            Type: PTR
  1054.             HostName: s11.fcomet.com            Type: MX
  1055.             HostName: www.tlwen.com.            Type: A
  1056.         IP: 184.154.7.82 (United States)
  1057.             HostName: ns1.s11.fcomet.com            Type: NS
  1058.             HostName: s11.fcomet.com            Type: PTR
  1059.             HostName: s11.fcomet.com            Type: MX
  1060.             HostName: www.tlwen.com.            Type: A
  1061.             HostName: ftp.tlwen.com.            Type: A
  1062.         IP: 184.154.7.82 (United States)
  1063.             HostName: ns1.s11.fcomet.com            Type: NS
  1064.             HostName: s11.fcomet.com            Type: PTR
  1065.             HostName: s11.fcomet.com            Type: MX
  1066.             HostName: www.tlwen.com.            Type: A
  1067.             HostName: ftp.tlwen.com.            Type: A
  1068.             HostName: mail.tlwen.com.           Type: A
  1069.         IP: 184.154.7.82 (United States)
  1070.             HostName: ns1.s11.fcomet.com            Type: NS
  1071.             HostName: s11.fcomet.com            Type: PTR
  1072.             HostName: s11.fcomet.com            Type: MX
  1073.             HostName: www.tlwen.com.            Type: A
  1074.             HostName: ftp.tlwen.com.            Type: A
  1075.             HostName: mail.tlwen.com.           Type: A
  1076.             HostName: webmail.tlwen.com.            Type: A
  1077.  
  1078.     Checking with nmap the reverse DNS hostnames of every <ip>/24 netblock using system default resolver...
  1079.         Checking netblock 184.154.7.0
  1080.  
  1081.     Searching for tlwen.com. emails in Google
  1082.  
  1083.     Checking 2 active hosts using nmap... (nmap -sn -n -v -PP -PM -PS80,25 -PA -PY -PU53,40125 -PE --reason <ip> -oA <output_directory>/nmap/<ip>.sn)
  1084.         Host 184.154.7.82 is up (reset ttl 64)
  1085.         Host 184.154.7.83 is up (reset ttl 64)
  1086.  
  1087.     Checking ports on every active host using nmap... (nmap -O --reason --webxml --traceroute -sS -sV -sC -Pn -n -v -F <ip> -oA <output_directory>/nmap/<ip>)
  1088.         Scanning ip 184.154.7.82 (webmail.tlwen.com.):
  1089.             21/tcp   open  ftp        syn-ack ttl 46 Pure-FTPd
  1090.                 | ssl-cert: Subject: commonName=s11.fcomet.com
  1091.                 | Subject Alternative Name: DNS:s11.fcomet.com, DNS:www.s11.fcomet.com
  1092.                 | Issuer: commonName=cPanel, Inc. Certification Authority/organizationName=cPanel, Inc./stateOrProvinceName=TX/countryName=US
  1093.                 | Public Key type: rsa
  1094.                 | Public Key bits: 2048
  1095.                 | Signature Algorithm: sha256WithRSAEncryption
  1096.                 | Not valid before: 2019-09-07T00:00:00
  1097.                 | Not valid after:  2020-09-06T23:59:59
  1098.                 | MD5:   bf68 eda8 c6b4 393c 3f6a 156d 13f1 6220
  1099.                 |_SHA-1: 0a8f 90b1 d068 4cb7 65a8 c26d 4dc9 5771 673e 6ad0
  1100.                 |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1101.             53/tcp   open  domain     syn-ack ttl 46 ISC BIND 9.8.2rc1 (RedHat Enterprise Linux 6)
  1102.                 | dns-nsid:
  1103.                 |_  bind.version: 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3
  1104.             80/tcp   open  http       syn-ack ttl 46 Apache httpd
  1105.                 | http-methods:
  1106.                 |_  Supported Methods: OPTIONS HEAD GET POST
  1107.                 |_http-server-header: Apache
  1108.                 |_http-title: Site doesn't have a title (text/html).
  1109.             110/tcp  open  pop3       syn-ack ttl 46 Dovecot pop3d
  1110.                 |_pop3-capabilities: USER TOP CAPA STLS PIPELINING AUTH-RESP-CODE UIDL SASL(PLAIN LOGIN) RESP-CODES
  1111.                 |_ssl-date: 2019-11-19T21:42:12+00:00; -1s from scanner time.
  1112.             111/tcp  open  rpcbind    syn-ack ttl 46 2-4 (RPC #100000)
  1113.                 | rpcinfo:
  1114.                 |   program version    port/proto  service
  1115.                 |   100000  2,3,4        111/tcp   rpcbind
  1116.                 |   100000  2,3,4        111/udp   rpcbind
  1117.                 |   100000  3,4          111/tcp6  rpcbind
  1118.                 |   100000  3,4          111/udp6  rpcbind
  1119.                 |   100024  1          37623/udp   status
  1120.                 |   100024  1          42042/tcp6  status
  1121.                 |   100024  1          44406/udp6  status
  1122.                 |_  100024  1          58386/tcp   status
  1123.             143/tcp  open  imap       syn-ack ttl 46 Dovecot imapd
  1124.                 |_imap-capabilities: LOGIN-REFERRALS SASL-IR capabilities LITERAL+ STARTTLS listed IDLE more NAMESPACE Pre-login IMAP4rev1 ENABLE post-login AUTH=LOGINA0001 AUTH=PLAIN have ID OK
  1125.                 |_ssl-date: 2019-11-19T21:42:12+00:00; -1s from scanner time.
  1126.             443/tcp  open  ssl/http   syn-ack ttl 46 Apache httpd
  1127.                 | http-methods:
  1128.                 |_  Supported Methods: OPTIONS HEAD GET POST
  1129.                 |_http-server-header: Apache
  1130.                 |_http-title: 400 Bad Request
  1131.                 | ssl-cert: Subject: commonName=nossl.s11.fcomet.com
  1132.                 | Subject Alternative Name: DNS:nossl.s11.fcomet.com
  1133.                 | Issuer: commonName=Let's Encrypt Authority X3/organizationName=Let's Encrypt/countryName=US
  1134.                 | Public Key type: rsa
  1135.                 | Public Key bits: 2048
  1136.                 | Signature Algorithm: sha256WithRSAEncryption
  1137.                 | Not valid before: 2019-09-26T12:28:23
  1138.                 | Not valid after:  2019-12-25T12:28:23
  1139.                 | MD5:   95ec ebcb 2da2 4e65 8cb4 7db3 2438 9f7d
  1140.                 |_SHA-1: ea19 ffdc be56 50d2 e0d5 5cb2 ea51 32c4 fc7b aec8
  1141.                 |_ssl-date: TLS randomness does not represent time
  1142.                 | tls-alpn:
  1143.                 |   h2
  1144.                 |_  http/1.1
  1145.             465/tcp  open  ssl/smtp   syn-ack ttl 46 Exim smtpd 4.92
  1146.                 | smtp-commands: s11.fcomet.com Hello nmap.scanme.org [45.132.192.24], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN, HELP,
  1147.                 |_ Commands supported: AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
  1148.                 | ssl-cert: Subject: commonName=s11.fcomet.com
  1149.                 | Subject Alternative Name: DNS:s11.fcomet.com, DNS:www.s11.fcomet.com
  1150.                 | Issuer: commonName=cPanel, Inc. Certification Authority/organizationName=cPanel, Inc./stateOrProvinceName=TX/countryName=US
  1151.                 | Public Key type: rsa
  1152.                 | Public Key bits: 2048
  1153.                 | Signature Algorithm: sha256WithRSAEncryption
  1154.                 | Not valid before: 2019-09-07T00:00:00
  1155.                 | Not valid after:  2020-09-06T23:59:59
  1156.                 | MD5:   bf68 eda8 c6b4 393c 3f6a 156d 13f1 6220
  1157.                 |_SHA-1: 0a8f 90b1 d068 4cb7 65a8 c26d 4dc9 5771 673e 6ad0
  1158.                 |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1159.                 | vulners:
  1160.                 |   cpe:/a:exim:exim:4.92:
  1161.                 |       CVE-2019-15846  10.0    https://vulners.com/cve/CVE-2019-15846
  1162.                 |       CVE-2019-13917  10.0    https://vulners.com/cve/CVE-2019-13917
  1163.                 |_      CVE-2019-16928  7.5 https://vulners.com/cve/CVE-2019-16928
  1164.             587/tcp  open  smtp       syn-ack ttl 46 Exim smtpd 4.92
  1165.                 | smtp-commands: s11.fcomet.com Hello nmap.scanme.org [45.132.192.24], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN, STARTTLS, HELP,
  1166.                 |_ Commands supported: AUTH STARTTLS HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
  1167.                 | ssl-cert: Subject: commonName=s11.fcomet.com
  1168.                 | Subject Alternative Name: DNS:s11.fcomet.com, DNS:www.s11.fcomet.com
  1169.                 | Issuer: commonName=cPanel, Inc. Certification Authority/organizationName=cPanel, Inc./stateOrProvinceName=TX/countryName=US
  1170.                 | Public Key type: rsa
  1171.                 | Public Key bits: 2048
  1172.                 | Signature Algorithm: sha256WithRSAEncryption
  1173.                 | Not valid before: 2019-09-07T00:00:00
  1174.                 | Not valid after:  2020-09-06T23:59:59
  1175.                 | MD5:   bf68 eda8 c6b4 393c 3f6a 156d 13f1 6220
  1176.                 |_SHA-1: 0a8f 90b1 d068 4cb7 65a8 c26d 4dc9 5771 673e 6ad0
  1177.                 |_ssl-date: 2019-11-19T21:42:12+00:00; -1s from scanner time.
  1178.                 | vulners:
  1179.                 |   cpe:/a:exim:exim:4.92:
  1180.                 |       CVE-2019-15846  10.0    https://vulners.com/cve/CVE-2019-15846
  1181.                 |       CVE-2019-13917  10.0    https://vulners.com/cve/CVE-2019-13917
  1182.                 |_      CVE-2019-16928  7.5 https://vulners.com/cve/CVE-2019-16928
  1183.             993/tcp  open  ssl/imaps? syn-ack ttl 46
  1184.                 |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1185.             995/tcp  open  ssl/pop3s? syn-ack ttl 46
  1186.                 |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1187.             3306/tcp open  mysql      syn-ack ttl 46 MySQL 5.7.28-log
  1188.                 | mysql-info:
  1189.                 |   Protocol: 10
  1190.                 |   Version: 5.7.28-log
  1191.                 |   Thread ID: 4712669
  1192.                 |   Capabilities flags: 65535
  1193.                 |   Some Capabilities: DontAllowDatabaseTableColumn, SupportsTransactions, Support41Auth, SupportsCompression, ConnectWithDatabase, InteractiveClient, Speaks41ProtocolNew, ODBCClient, FoundRows, LongPassword, IgnoreSpaceBeforeParenthesis, IgnoreSigpipes, LongColumnFlag, Speaks41ProtocolOld, SwitchToSSLAfterHandshake, SupportsLoadDataLocal, SupportsMultipleStatments, SupportsAuthPlugins, SupportsMultipleResults
  1194.                 |   Status: Autocommit
  1195.                 |   Salt: \x15\x01\x0CF8m5x\x019p/Sx1h\x02\x143%
  1196.                 |_  Auth Plugin Name: mysql_native_password
  1197.                 | vulners:
  1198.                 |   MySQL 5.7.28-log:
  1199.                 |_      NODEJS:602  0.0 https://vulners.com/nodejs/NODEJS:602
  1200.                 Device type: general purpose|WAP|webcam|storage-misc|broadband router|router|media device
  1201.                 Running (JUST GUESSING): Linux 2.6.X|3.X (92%), Ubiquiti embedded (91%), Tandberg embedded (90%), HP embedded (89%), MikroTik RouterOS 6.X (89%), Ubiquiti AirOS 5.X (89%)
  1202.             OS Info: Service Info: Host: s11.fcomet.com; OS: Linux; CPE: cpe:/o:redhat:enterprise_linux:6
  1203.                 |_clock-skew: mean: -1s, deviation: 0s, median: -1s
  1204.         Scanning ip 184.154.7.83 (s11.fcomet.com (PTR)):
  1205.     WebCrawling domain's web servers... up to 50 max links.
  1206.  
  1207.     + URL to crawl: http://webmail.tlwen.com.
  1208.     + Date: 2019-11-19
  1209.  
  1210.     + Crawling URL: http://webmail.tlwen.com.:
  1211.         + Links:
  1212.             + Crawling http://webmail.tlwen.com.
  1213.         + Searching for directories...
  1214.         + Searching open folders...
  1215.  
  1216.  
  1217.     + URL to crawl: http://www.tlwen.com.
  1218.     + Date: 2019-11-19
  1219.  
  1220.     + Crawling URL: http://www.tlwen.com.:
  1221.         + Links:
  1222.             + Crawling http://www.tlwen.com.
  1223.             + Crawling http://www.tlwen.com./clientscript/vbulletin_important.css?v=389
  1224.             + Crawling http://www.tlwen.com./clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389
  1225.             + Crawling http://www.tlwen.com./clientscript/yui/connection/connection-min.js?v=389
  1226.             + Crawling http://www.tlwen.com./clientscript/vbulletin_global.js?v=389
  1227.             + Crawling http://www.tlwen.com./clientscript/vbulletin_menu.js?v=389
  1228.             + Crawling http://www.tlwen.com./external.php?type=RSS2
  1229.             + Crawling http://www.tlwen.com./clientscript/vbulletin_md5.js?v=389
  1230.             + Crawling http://www.tlwen.com./register.php?s=968380374f06d81b9af0355f74693ef3
  1231.             + Crawling http://www.tlwen.com./search.php?s=968380374f06d81b9af0355f74693ef3&amp;do=getdaily
  1232.             + Crawling http://www.tlwen.com./search.php?s=968380374f06d81b9af0355f74693ef3
  1233.             + Crawling http://www.tlwen.com./tags.php?s=968380374f06d81b9af0355f74693ef3
  1234.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=1
  1235.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=2
  1236.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=829
  1237.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=2
  1238.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=975
  1239.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=3
  1240.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=917
  1241.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=3
  1242.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1099
  1243.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=6
  1244.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=7
  1245.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=946
  1246.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=6
  1247.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1131
  1248.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=20
  1249.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=24
  1250.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=954
  1251.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=24
  1252.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1130
  1253.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=25
  1254.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=874
  1255.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=25
  1256.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1026
  1257.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=18
  1258.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=26
  1259.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=951
  1260.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=18
  1261.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1124
  1262.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=4
  1263.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=950
  1264.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=4
  1265.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1123
  1266.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=19
  1267.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=922
  1268.             + Crawling http://www.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=19
  1269.             + Crawling http://www.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1085
  1270.             + Crawling http://www.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;do=markread&amp;markreadhash=guest
  1271.             + Crawling http://www.tlwen.com./showgroups.php?s=968380374f06d81b9af0355f74693ef3
  1272.                 > No more URLs to crawl.
  1273.  
  1274.         + Searching for directories...
  1275.             - Found: http://www.tlwen.com./fontawesome/
  1276.             - Found: http://www.tlwen.com./fontawesome/css/
  1277.             - Found: http://www.tlwen.com./images/
  1278.             - Found: http://www.tlwen.com./images/links/
  1279.             - Found: http://www.tlwen.com./pagead2.googlesyndication.com/
  1280.             - Found: http://www.tlwen.com./pagead2.googlesyndication.com/pagead/
  1281.             - Found: http://www.tlwen.com./pagead2.googlesyndication.com/pagead/js/
  1282.             - Found: http://www.tlwen.com./images/misc/
  1283.             - Found: http://www.tlwen.com./images/links/statusicon/
  1284.             - Found: http://www.tlwen.com./images/links/buttons/
  1285.             - Found: http://www.tlwen.com./images/links/misc/
  1286.         + Searching open folders...
  1287.             - http://www.tlwen.com./fontawesome/  (No Open Folder)
  1288.             - http://www.tlwen.com./fontawesome/css/  (No Open Folder)
  1289.             - http://www.tlwen.com./images/  (No Open Folder)
  1290.             - http://www.tlwen.com./images/links/  (No Open Folder)
  1291.             - http://www.tlwen.com./pagead2.googlesyndication.com/  (No Open Folder)
  1292.             - http://www.tlwen.com./pagead2.googlesyndication.com/pagead/  (No Open Folder)
  1293.             - http://www.tlwen.com./pagead2.googlesyndication.com/pagead/js/  (No Open Folder)
  1294.             - http://www.tlwen.com./images/misc/  (No Open Folder)
  1295.             - http://www.tlwen.com./images/links/statusicon/  (No Open Folder)
  1296.             - http://www.tlwen.com./images/links/buttons/  (No Open Folder)
  1297.             - http://www.tlwen.com./images/links/misc/  (No Open Folder)
  1298.  
  1299.  
  1300.     + URL to crawl: http://ftp.tlwen.com.
  1301.     + Date: 2019-11-19
  1302.  
  1303.     + Crawling URL: http://ftp.tlwen.com.:
  1304.         + Links:
  1305.             + Crawling http://ftp.tlwen.com. (REDIRECTING TO: /cgi-sys/defaultwebpage.cgi)
  1306.         + Searching for directories...
  1307.         + Searching open folders...
  1308.  
  1309.  
  1310.     + URL to crawl: http://mail.tlwen.com.
  1311.     + Date: 2019-11-19
  1312.  
  1313.     + Crawling URL: http://mail.tlwen.com.:
  1314.         + Links:
  1315.             + Crawling http://mail.tlwen.com.
  1316.             + Crawling http://mail.tlwen.com./clientscript/vbulletin_important.css?v=389
  1317.             + Crawling http://mail.tlwen.com./clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389
  1318.             + Crawling http://mail.tlwen.com./clientscript/yui/connection/connection-min.js?v=389
  1319.             + Crawling http://mail.tlwen.com./clientscript/vbulletin_global.js?v=389
  1320.             + Crawling http://mail.tlwen.com./clientscript/vbulletin_menu.js?v=389
  1321.             + Crawling http://mail.tlwen.com./external.php?type=RSS2
  1322.             + Crawling http://mail.tlwen.com./clientscript/vbulletin_md5.js?v=389
  1323.             + Crawling http://mail.tlwen.com./register.php?s=968380374f06d81b9af0355f74693ef3
  1324.             + Crawling http://mail.tlwen.com./search.php?s=968380374f06d81b9af0355f74693ef3&amp;do=getdaily
  1325.             + Crawling http://mail.tlwen.com./search.php?s=968380374f06d81b9af0355f74693ef3
  1326.             + Crawling http://mail.tlwen.com./tags.php?s=968380374f06d81b9af0355f74693ef3
  1327.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=1
  1328.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=2
  1329.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=829
  1330.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=2
  1331.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=975
  1332.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=3
  1333.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=917
  1334.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=3
  1335.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1099
  1336.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=6
  1337.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=7
  1338.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=946
  1339.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=6
  1340.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1131
  1341.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=20
  1342.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=24
  1343.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=954
  1344.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=24
  1345.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1130
  1346.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=25
  1347.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=874
  1348.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=25
  1349.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1026
  1350.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=18
  1351.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=26
  1352.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=951
  1353.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=18
  1354.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1124
  1355.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=4
  1356.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=950
  1357.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=4
  1358.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1123
  1359.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;f=19
  1360.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;goto=newpost&amp;t=922
  1361.             + Crawling http://mail.tlwen.com./member.php?s=968380374f06d81b9af0355f74693ef3&amp;find=lastposter&amp;f=19
  1362.             + Crawling http://mail.tlwen.com./showthread.php?s=968380374f06d81b9af0355f74693ef3&amp;p=1085
  1363.             + Crawling http://mail.tlwen.com./forumdisplay.php?s=968380374f06d81b9af0355f74693ef3&amp;do=markread&amp;markreadhash=guest
  1364.             + Crawling http://mail.tlwen.com./showgroups.php?s=968380374f06d81b9af0355f74693ef3
  1365.                 > No more URLs to crawl.
  1366.  
  1367.         + Searching for directories...
  1368.             - Found: http://mail.tlwen.com./fontawesome/
  1369.             - Found: http://mail.tlwen.com./fontawesome/css/
  1370.             - Found: http://mail.tlwen.com./images/
  1371.             - Found: http://mail.tlwen.com./images/links/
  1372.             - Found: http://mail.tlwen.com./pagead2.googlesyndication.com/
  1373.             - Found: http://mail.tlwen.com./pagead2.googlesyndication.com/pagead/
  1374.             - Found: http://mail.tlwen.com./pagead2.googlesyndication.com/pagead/js/
  1375.             - Found: http://mail.tlwen.com./images/misc/
  1376.             - Found: http://mail.tlwen.com./images/links/statusicon/
  1377.             - Found: http://mail.tlwen.com./images/links/buttons/
  1378.             - Found: http://mail.tlwen.com./images/links/misc/
  1379.         + Searching open folders...
  1380.             - http://mail.tlwen.com./fontawesome/  (No Open Folder)
  1381.             - http://mail.tlwen.com./fontawesome/css/  (No Open Folder)
  1382.             - http://mail.tlwen.com./images/  (No Open Folder)
  1383.             - http://mail.tlwen.com./images/links/  (No Open Folder)
  1384.             - http://mail.tlwen.com./pagead2.googlesyndication.com/  (No Open Folder)
  1385.             - http://mail.tlwen.com./pagead2.googlesyndication.com/pagead/  (No Open Folder)
  1386.             - http://mail.tlwen.com./pagead2.googlesyndication.com/pagead/js/  (No Open Folder)
  1387.             - http://mail.tlwen.com./images/misc/  (No Open Folder)
  1388.             - http://mail.tlwen.com./images/links/statusicon/  (No Open Folder)
  1389.             - http://mail.tlwen.com./images/links/buttons/  (No Open Folder)
  1390.             - http://mail.tlwen.com./images/links/misc/  (No Open Folder)
  1391.  
  1392.  
  1393.     + URL to crawl: http://ns1.s11.fcomet.com
  1394.     + Date: 2019-11-19
  1395.  
  1396.     + Crawling URL: http://ns1.s11.fcomet.com:
  1397.         + Links:
  1398.             + Crawling http://ns1.s11.fcomet.com (REDIRECTING TO: /cgi-sys/defaultwebpage.cgi)
  1399.         + Searching for directories...
  1400.         + Searching open folders...
  1401.  
  1402.  
  1403.     + URL to crawl: http://s11.fcomet.com
  1404.     + Date: 2019-11-19
  1405.  
  1406.     + Crawling URL: http://s11.fcomet.com:
  1407.         + Links:
  1408.             + Crawling http://s11.fcomet.com (REDIRECTING TO: /cgi-sys/defaultwebpage.cgi)
  1409.         + Searching for directories...
  1410.         + Searching open folders...
  1411.  
  1412.  
  1413.     + URL to crawl: https://webmail.tlwen.com.
  1414.     + Date: 2019-11-19
  1415.  
  1416.     + Crawling URL: https://webmail.tlwen.com.:
  1417.         + Links:
  1418.             + Crawling https://webmail.tlwen.com.
  1419.         + Searching for directories...
  1420.         + Searching open folders...
  1421.  
  1422.  
  1423.     + URL to crawl: https://www.tlwen.com.
  1424.     + Date: 2019-11-19
  1425.  
  1426.     + Crawling URL: https://www.tlwen.com.:
  1427.         + Links:
  1428.             + Crawling https://www.tlwen.com.
  1429.         + Searching for directories...
  1430.         + Searching open folders...
  1431.  
  1432.  
  1433.     + URL to crawl: https://ftp.tlwen.com.
  1434.     + Date: 2019-11-19
  1435.  
  1436.     + Crawling URL: https://ftp.tlwen.com.:
  1437.         + Links:
  1438.             + Crawling https://ftp.tlwen.com.
  1439.         + Searching for directories...
  1440.         + Searching open folders...
  1441.  
  1442.  
  1443.     + URL to crawl: https://mail.tlwen.com.
  1444.     + Date: 2019-11-19
  1445.  
  1446.     + Crawling URL: https://mail.tlwen.com.:
  1447.         + Links:
  1448.             + Crawling https://mail.tlwen.com.
  1449.         + Searching for directories...
  1450.         + Searching open folders...
  1451.  
  1452.  
  1453.     + URL to crawl: https://ns1.s11.fcomet.com
  1454.     + Date: 2019-11-19
  1455.  
  1456.     + Crawling URL: https://ns1.s11.fcomet.com:
  1457.         + Links:
  1458.             + Crawling https://ns1.s11.fcomet.com
  1459.         + Searching for directories...
  1460.         + Searching open folders...
  1461.  
  1462.  
  1463.     + URL to crawl: https://s11.fcomet.com
  1464.     + Date: 2019-11-19
  1465.  
  1466.     + Crawling URL: https://s11.fcomet.com:
  1467.         + Links:
  1468.             + Crawling https://s11.fcomet.com (REDIRECTING TO: /cgi-sys/defaultwebpage.cgi)
  1469.         + Searching for directories...
  1470.         + Searching open folders...
  1471.  
  1472. --Finished--
  1473. Summary information for domain tlwen.com.
  1474. -----------------------------------------
  1475.  
  1476.     Domain Ips Information:
  1477.         IP: 184.154.7.82
  1478.             HostName: ns1.s11.fcomet.com            Type: NS
  1479.             HostName: s11.fcomet.com            Type: PTR
  1480.             HostName: s11.fcomet.com            Type: MX
  1481.             HostName: www.tlwen.com.            Type: A
  1482.             HostName: ftp.tlwen.com.            Type: A
  1483.             HostName: mail.tlwen.com.           Type: A
  1484.             HostName: webmail.tlwen.com.            Type: A
  1485.             Country: United States
  1486.             Is Active: True (reset ttl 64)
  1487.             Port: 21/tcp   open  ftp        syn-ack ttl 46 Pure-FTPd
  1488.                 Script Info: | ssl-cert: Subject: commonName=s11.fcomet.com
  1489.                 Script Info: | Subject Alternative Name: DNS:s11.fcomet.com, DNS:www.s11.fcomet.com
  1490.                 Script Info: | Issuer: commonName=cPanel, Inc. Certification Authority/organizationName=cPanel, Inc./stateOrProvinceName=TX/countryName=US
  1491.                 Script Info: | Public Key type: rsa
  1492.                 Script Info: | Public Key bits: 2048
  1493.                 Script Info: | Signature Algorithm: sha256WithRSAEncryption
  1494.                 Script Info: | Not valid before: 2019-09-07T00:00:00
  1495.                 Script Info: | Not valid after:  2020-09-06T23:59:59
  1496.                 Script Info: | MD5:   bf68 eda8 c6b4 393c 3f6a 156d 13f1 6220
  1497.                 Script Info: |_SHA-1: 0a8f 90b1 d068 4cb7 65a8 c26d 4dc9 5771 673e 6ad0
  1498.                 Script Info: |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1499.             Port: 53/tcp   open  domain     syn-ack ttl 46 ISC BIND 9.8.2rc1 (RedHat Enterprise Linux 6)
  1500.                 Script Info: | dns-nsid:
  1501.                 Script Info: |_  bind.version: 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3
  1502.             Port: 80/tcp   open  http       syn-ack ttl 46 Apache httpd
  1503.                 Script Info: | http-methods:
  1504.                 Script Info: |_  Supported Methods: OPTIONS HEAD GET POST
  1505.                 Script Info: |_http-server-header: Apache
  1506.                 Script Info: |_http-title: Site doesn't have a title (text/html).
  1507.             Port: 110/tcp  open  pop3       syn-ack ttl 46 Dovecot pop3d
  1508.                 Script Info: |_pop3-capabilities: USER TOP CAPA STLS PIPELINING AUTH-RESP-CODE UIDL SASL(PLAIN LOGIN) RESP-CODES
  1509.                 Script Info: |_ssl-date: 2019-11-19T21:42:12+00:00; -1s from scanner time.
  1510.             Port: 111/tcp  open  rpcbind    syn-ack ttl 46 2-4 (RPC #100000)
  1511.                 Script Info: | rpcinfo:
  1512.                 Script Info: |   program version    port/proto  service
  1513.                 Script Info: |   100000  2,3,4        111/tcp   rpcbind
  1514.                 Script Info: |   100000  2,3,4        111/udp   rpcbind
  1515.                 Script Info: |   100000  3,4          111/tcp6  rpcbind
  1516.                 Script Info: |   100000  3,4          111/udp6  rpcbind
  1517.                 Script Info: |   100024  1          37623/udp   status
  1518.                 Script Info: |   100024  1          42042/tcp6  status
  1519.                 Script Info: |   100024  1          44406/udp6  status
  1520.                 Script Info: |_  100024  1          58386/tcp   status
  1521.             Port: 143/tcp  open  imap       syn-ack ttl 46 Dovecot imapd
  1522.                 Script Info: |_imap-capabilities: LOGIN-REFERRALS SASL-IR capabilities LITERAL+ STARTTLS listed IDLE more NAMESPACE Pre-login IMAP4rev1 ENABLE post-login AUTH=LOGINA0001 AUTH=PLAIN have ID OK
  1523.                 Script Info: |_ssl-date: 2019-11-19T21:42:12+00:00; -1s from scanner time.
  1524.             Port: 443/tcp  open  ssl/http   syn-ack ttl 46 Apache httpd
  1525.                 Script Info: | http-methods:
  1526.                 Script Info: |_  Supported Methods: OPTIONS HEAD GET POST
  1527.                 Script Info: |_http-server-header: Apache
  1528.                 Script Info: |_http-title: 400 Bad Request
  1529.                 Script Info: | ssl-cert: Subject: commonName=nossl.s11.fcomet.com
  1530.                 Script Info: | Subject Alternative Name: DNS:nossl.s11.fcomet.com
  1531.                 Script Info: | Issuer: commonName=Let's Encrypt Authority X3/organizationName=Let's Encrypt/countryName=US
  1532.                 Script Info: | Public Key type: rsa
  1533.                 Script Info: | Public Key bits: 2048
  1534.                 Script Info: | Signature Algorithm: sha256WithRSAEncryption
  1535.                 Script Info: | Not valid before: 2019-09-26T12:28:23
  1536.                 Script Info: | Not valid after:  2019-12-25T12:28:23
  1537.                 Script Info: | MD5:   95ec ebcb 2da2 4e65 8cb4 7db3 2438 9f7d
  1538.                 Script Info: |_SHA-1: ea19 ffdc be56 50d2 e0d5 5cb2 ea51 32c4 fc7b aec8
  1539.                 Script Info: |_ssl-date: TLS randomness does not represent time
  1540.                 Script Info: | tls-alpn:
  1541.                 Script Info: |   h2
  1542.                 Script Info: |_  http/1.1
  1543.             Port: 465/tcp  open  ssl/smtp   syn-ack ttl 46 Exim smtpd 4.92
  1544.                 Script Info: | smtp-commands: s11.fcomet.com Hello nmap.scanme.org [45.132.192.24], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN, HELP,
  1545.                 Script Info: |_ Commands supported: AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
  1546.                 Script Info: | ssl-cert: Subject: commonName=s11.fcomet.com
  1547.                 Script Info: | Subject Alternative Name: DNS:s11.fcomet.com, DNS:www.s11.fcomet.com
  1548.                 Script Info: | Issuer: commonName=cPanel, Inc. Certification Authority/organizationName=cPanel, Inc./stateOrProvinceName=TX/countryName=US
  1549.                 Script Info: | Public Key type: rsa
  1550.                 Script Info: | Public Key bits: 2048
  1551.                 Script Info: | Signature Algorithm: sha256WithRSAEncryption
  1552.                 Script Info: | Not valid before: 2019-09-07T00:00:00
  1553.                 Script Info: | Not valid after:  2020-09-06T23:59:59
  1554.                 Script Info: | MD5:   bf68 eda8 c6b4 393c 3f6a 156d 13f1 6220
  1555.                 Script Info: |_SHA-1: 0a8f 90b1 d068 4cb7 65a8 c26d 4dc9 5771 673e 6ad0
  1556.                 Script Info: |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1557.                 Script Info: | vulners:
  1558.                 Script Info: |   cpe:/a:exim:exim:4.92:
  1559.                 Script Info: |      CVE-2019-15846  10.0    https://vulners.com/cve/CVE-2019-15846
  1560.                 Script Info: |      CVE-2019-13917  10.0    https://vulners.com/cve/CVE-2019-13917
  1561.                 Script Info: |_     CVE-2019-16928  7.5 https://vulners.com/cve/CVE-2019-16928
  1562.             Port: 587/tcp  open  smtp       syn-ack ttl 46 Exim smtpd 4.92
  1563.                 Script Info: | smtp-commands: s11.fcomet.com Hello nmap.scanme.org [45.132.192.24], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN, STARTTLS, HELP,
  1564.                 Script Info: |_ Commands supported: AUTH STARTTLS HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
  1565.                 Script Info: | ssl-cert: Subject: commonName=s11.fcomet.com
  1566.                 Script Info: | Subject Alternative Name: DNS:s11.fcomet.com, DNS:www.s11.fcomet.com
  1567.                 Script Info: | Issuer: commonName=cPanel, Inc. Certification Authority/organizationName=cPanel, Inc./stateOrProvinceName=TX/countryName=US
  1568.                 Script Info: | Public Key type: rsa
  1569.                 Script Info: | Public Key bits: 2048
  1570.                 Script Info: | Signature Algorithm: sha256WithRSAEncryption
  1571.                 Script Info: | Not valid before: 2019-09-07T00:00:00
  1572.                 Script Info: | Not valid after:  2020-09-06T23:59:59
  1573.                 Script Info: | MD5:   bf68 eda8 c6b4 393c 3f6a 156d 13f1 6220
  1574.                 Script Info: |_SHA-1: 0a8f 90b1 d068 4cb7 65a8 c26d 4dc9 5771 673e 6ad0
  1575.                 Script Info: |_ssl-date: 2019-11-19T21:42:12+00:00; -1s from scanner time.
  1576.                 Script Info: | vulners:
  1577.                 Script Info: |   cpe:/a:exim:exim:4.92:
  1578.                 Script Info: |      CVE-2019-15846  10.0    https://vulners.com/cve/CVE-2019-15846
  1579.                 Script Info: |      CVE-2019-13917  10.0    https://vulners.com/cve/CVE-2019-13917
  1580.                 Script Info: |_     CVE-2019-16928  7.5 https://vulners.com/cve/CVE-2019-16928
  1581.             Port: 993/tcp  open  ssl/imaps? syn-ack ttl 46
  1582.                 Script Info: |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1583.             Port: 995/tcp  open  ssl/pop3s? syn-ack ttl 46
  1584.                 Script Info: |_ssl-date: 2019-11-19T21:42:11+00:00; -1s from scanner time.
  1585.             Port: 3306/tcp open  mysql      syn-ack ttl 46 MySQL 5.7.28-log
  1586.                 Script Info: | mysql-info:
  1587.                 Script Info: |   Protocol: 10
  1588.                 Script Info: |   Version: 5.7.28-log
  1589.                 Script Info: |   Thread ID: 4712669
  1590.                 Script Info: |   Capabilities flags: 65535
  1591.                 Script Info: |   Some Capabilities: DontAllowDatabaseTableColumn, SupportsTransactions, Support41Auth, SupportsCompression, ConnectWithDatabase, InteractiveClient, Speaks41ProtocolNew, ODBCClient, FoundRows, LongPassword, IgnoreSpaceBeforeParenthesis, IgnoreSigpipes, LongColumnFlag, Speaks41ProtocolOld, SwitchToSSLAfterHandshake, SupportsLoadDataLocal, SupportsMultipleStatments, SupportsAuthPlugins, SupportsMultipleResults
  1592.                 Script Info: |   Status: Autocommit
  1593.                 Script Info: |   Salt: \x15\x01\x0CF8m5x\x019p/Sx1h\x02\x143%
  1594.                 Script Info: |_  Auth Plugin Name: mysql_native_password
  1595.                 Script Info: | vulners:
  1596.                 Script Info: |   MySQL 5.7.28-log:
  1597.                 Script Info: |_     NODEJS:602  0.0 https://vulners.com/nodejs/NODEJS:602
  1598.                 Script Info: Device type: general purpose|WAP|webcam|storage-misc|broadband router|router|media device
  1599.                 Script Info: Running (JUST GUESSING): Linux 2.6.X|3.X (92%), Ubiquiti embedded (91%), Tandberg embedded (90%), HP embedded (89%), MikroTik RouterOS 6.X (89%), Ubiquiti AirOS 5.X (89%)
  1600.             Os Info:  Host: s11.fcomet.com; OS: Linux; CPE: cpe:/o:redhat:enterprise_linux:6
  1601.                 Script Info: |_clock-skew: mean: -1s, deviation: 0s, median: -1s
  1602.         IP: 184.154.7.83
  1603.             HostName: ns2.s11.fcomet.com            Type: NS
  1604.             HostName: s11.fcomet.com            Type: PTR
  1605.             Country: United States
  1606.             Is Active: True (reset ttl 64)
  1607.  
  1608. --------------End Summary --------------
  1609. -----------------------------------------
  1610. ######################################################################################################################################
  1611. 1  10.231.200.1 (10.231.200.1)  127.222 ms  127.225 ms  127.239 ms
  1612.  2  * * *
  1613.  3  te0-0-2-1.nr11.b069785-0.tll01.atlas.cogentco.com (149.6.188.49)  127.927 ms  127.941 ms  127.947 ms
  1614.  4  be2160.rcr51.tll01.atlas.cogentco.com (154.25.10.249)  127.808 ms  127.859 ms  127.828 ms
  1615.  5  be3741.ccr22.sto03.atlas.cogentco.com (154.54.60.194)  133.236 ms be3740.ccr21.sto03.atlas.cogentco.com (154.54.60.190)  133.184 ms be3741.ccr22.sto03.atlas.cogentco.com (154.54.60.194)  133.298 ms
  1616.  6  be3376.ccr21.sto01.atlas.cogentco.com (130.117.50.226)  133.309 ms  132.692 ms be3377.ccr21.sto01.atlas.cogentco.com (154.54.36.90)  132.459 ms
  1617.  7  gtt-tinet.sto01.atlas.cogentco.com (130.117.15.138)  136.842 ms  136.696 ms  136.668 ms
  1618.  8  xe-0-1-0.cr1-chi1.ip4.gtt.net (213.254.231.185)  261.554 ms  261.707 ms  261.618 ms
  1619.  9  ip4.gtt.net (173.205.41.90)  259.406 ms  259.323 ms  259.115 ms
  1620. 10  agg1.c13.r13.s101.chi03.singlehop.net (67.212.190.234)  278.652 ms  278.665 ms  291.546 ms
  1621. 11  aswg1.c03.r13.s101.chi03.singlehop.net (67.212.183.194)  258.897 ms  258.772 ms  258.722 ms
  1622. 12  s11.fcomet.com (184.154.7.82)  258.661 ms  258.065 ms  258.007 ms
  1623. #######################################################################################################################################
  1624. -----   tlwen.com   -----
  1625.  
  1626.  
  1627. Host's addresses:
  1628. __________________
  1629.  
  1630. tlwen.com.                               12457    IN    A        184.154.7.82
  1631.  
  1632.  
  1633. Name Servers:
  1634. ______________
  1635.  
  1636. ns2.s11.fcomet.com.                      84455    IN    A        184.154.7.83
  1637. ns1.s11.fcomet.com.                      84844    IN    A        184.154.7.82
  1638.  
  1639.  
  1640. Mail (MX) Servers:
  1641. ___________________
  1642.  
  1643. s11.fcomet.com.                          37398    IN    A        184.154.7.82
  1644.  
  1645.  
  1646. Trying Zone Transfers and getting Bind Versions:
  1647. _________________________________________________
  1648.  
  1649.  
  1650. Trying Zone Transfer for tlwen.com on ns1.s11.fcomet.com ...
  1651. AXFR record query failed: REFUSED
  1652. Use of uninitialized value $error[0] in join or string at /usr/share/perl/5.30/Carp.pm line 630.
  1653.  
  1654. Trying Zone Transfer for tlwen.com on ns2.s11.fcomet.com ...
  1655. Use of uninitialized value in warn at /usr/bin/dnsenum line 942.
  1656. AXFR record query failed:
  1657.  
  1658.  
  1659. Scraping tlwen.com subdomains from Google:
  1660. ___________________________________________
  1661.  
  1662.  
  1663.  ----   Google search page: 1   ----
  1664.  
  1665.  
  1666.  ----   Google search page: 2   ----
  1667.  
  1668.  
  1669.  ----   Google search page: 3   ----
  1670.  
  1671.  
  1672.  ----   Google search page: 4   ----
  1673.  
  1674.  
  1675.  ----   Google search page: 5   ----
  1676.  
  1677.  
  1678.  
  1679. Google Results:
  1680. ________________
  1681.  
  1682.   perhaps Google is blocking our queries.
  1683.  Check manually.
  1684.  
  1685.  
  1686. Brute forcing with /usr/share/dnsenum/dns.txt:
  1687. _______________________________________________
  1688.  
  1689. ftp.tlwen.com.                           12803    IN    A        184.154.7.82
  1690. mail.tlwen.com.                          12792    IN    CNAME    tlwen.com.
  1691. tlwen.com.                               12901    IN    A        184.154.7.82
  1692. webmail.tlwen.com.                       12771    IN    A        184.154.7.82
  1693. www.tlwen.com.                           12868    IN    CNAME    tlwen.com.
  1694. tlwen.com.                               12868    IN    A        184.154.7.82
  1695.  
  1696.  
  1697. Launching Whois Queries:
  1698. _________________________
  1699.  
  1700.  whois ip result:   184.154.7.0        ->      184.154.0.0/16
  1701. #######################################################################################################################################
  1702. Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-19 16:52 EST
  1703. Nmap scan report for s11.fcomet.com (184.154.7.82)
  1704. Host is up (0.28s latency).
  1705. Not shown: 987 closed ports
  1706. PORT     STATE SERVICE
  1707. 21/tcp   open  ftp
  1708. 53/tcp   open  domain
  1709. 80/tcp   open  http
  1710. 110/tcp  open  pop3
  1711. 111/tcp  open  rpcbind
  1712. 143/tcp  open  imap
  1713. 443/tcp  open  https
  1714. 465/tcp  open  smtps
  1715. 587/tcp  open  submission
  1716. 993/tcp  open  imaps
  1717. 995/tcp  open  pop3s
  1718. 3306/tcp open  mysql
  1719. 5960/tcp open  unknown
  1720.  
  1721. Nmap done: 1 IP address (1 host up) scanned in 2.44 seconds
  1722. #####################################################################################################################################
  1723. Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-19 16:52 EST
  1724. Nmap scan report for s11.fcomet.com (184.154.7.82)
  1725. Host is up (0.24s latency).
  1726. Not shown: 12 closed ports, 2 filtered ports
  1727. PORT   STATE SERVICE
  1728. 53/udp open  domain
  1729.  
  1730. Nmap done: 1 IP address (1 host up) scanned in 7.78 seconds
  1731. ######################################################################################################################################
  1732. Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-19 16:52 EST
  1733. NSE: [ftp-brute] usernames: Time limit 10m00s exceeded.
  1734. NSE: [ftp-brute] usernames: Time limit 10m00s exceeded.
  1735. NSE: [ftp-brute] passwords: Time limit 10m00s exceeded.
  1736. Nmap scan report for s11.fcomet.com (184.154.7.82)
  1737. Host is up (0.26s latency).
  1738.  
  1739. PORT   STATE SERVICE VERSION
  1740. 21/tcp open  ftp     Pure-FTPd
  1741. | ftp-brute:
  1742. |   Accounts: No valid accounts found
  1743. |_  Statistics: Performed 10749 guesses in 604 seconds, average tps: 17.5
  1744. | vulscan: VulDB - https://vuldb.com:
  1745. | [102925] Foscam C1 Indoor HD Camera 2.52.2.37 Web Management Interface pureftpd.passwd HTTP Request privilege escalation
  1746. | [57510] Pureftpd Pure-FTPd up to 0.x Memory Consumption denial of service
  1747. | [57504] Pureftpd Pure-FTPd up to 0.x ftp_parser.c Cleartext unknown vulnerability
  1748. |
  1749. | MITRE CVE - https://cve.mitre.org:
  1750. | [CVE-2004-0656] The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.
  1751. |
  1752. | SecurityFocus - https://www.securityfocus.com/bid/:
  1753. | [10664] PureFTPd Accept_Client Remote Denial of Service Vulnerability
  1754. |
  1755. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  1756. | No findings
  1757. |
  1758. | Exploit-DB - https://www.exploit-db.com:
  1759. | No findings
  1760. |
  1761. | OpenVAS (Nessus) - http://www.openvas.org:
  1762. | No findings
  1763. |
  1764. | SecurityTracker - https://www.securitytracker.com:
  1765. | [1010701] PureFTPd Logic Bug in accept_client() Lets Remote Users Crash the FTP Daemon
  1766. | [1008135] (Claim is Retracted) PureFTPd Buffer Overflow in displayrate() Lets Remote Users Crash the Service
  1767. | [1002993] PurePostPro Script Add-on for PureFTPd and MySQL Allows Remote Users to Execute SQL Commands on the Server
  1768. | [1001126] PureFTPd May Allow Remote Users to Deny Service on the Server
  1769. |
  1770. | OSVDB - http://www.osvdb.org:
  1771. | No findings
  1772. |_
  1773. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1774. Aggressive OS guesses: Linux 2.6.32 (92%), Ubiquiti AirMax NanoStation WAP (Linux 2.6.32) (92%), Linux 3.11 (92%), Linux 3.5 (92%), Linux 3.8 (92%), Linux 2.6.32 - 3.10 (91%), Linux 2.6.32 - 3.13 (91%), Linux 2.6.32 - 3.9 (91%), Linux 3.2 (91%), Linux 2.6.32 - 3.1 (91%)
  1775. No exact OS matches for host (test conditions non-ideal).
  1776. Network Distance: 12 hops
  1777.  
  1778. TRACEROUTE (using port 21/tcp)
  1779. HOP RTT       ADDRESS
  1780. 1   125.88 ms 10.231.200.1
  1781. 2   ...
  1782. 3   133.74 ms te0-0-2-1.nr11.b069785-0.tll01.atlas.cogentco.com (149.6.188.49)
  1783. 4   131.33 ms be2160.rcr51.tll01.atlas.cogentco.com (154.25.10.249)
  1784. 5   137.54 ms be3741.ccr22.sto03.atlas.cogentco.com (154.54.60.194)
  1785. 6   137.59 ms be3377.ccr21.sto01.atlas.cogentco.com (154.54.36.90)
  1786. 7   132.35 ms gtt-tinet.sto01.atlas.cogentco.com (130.117.15.138)
  1787. 8   253.60 ms xe-0-2-1.cr1-chi1.ip4.gtt.net (213.254.231.157)
  1788. 9   255.38 ms ip4.gtt.net (173.205.41.90)
  1789. 10  277.47 ms agg1.c13.r13.s101.chi03.singlehop.net (67.212.190.234)
  1790. 11  257.58 ms aswg1.c03.r13.s101.chi03.singlehop.net (67.212.183.194)
  1791. 12  254.26 ms s11.fcomet.com (184.154.7.82)
  1792. ######################################################################################################################################
  1793. Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-19 17:03 EST
  1794. Nmap scan report for s11.fcomet.com (184.154.7.82)
  1795. Host is up (0.26s latency).
  1796.  
  1797. PORT   STATE SERVICE VERSION
  1798. 53/tcp open  domain  ISC BIND 9.8.2rc1 (RedHat Enterprise Linux 6)
  1799. |_dns-fuzz: Server didn't response to our probe, can't fuzz
  1800. | dns-nsec-enum:
  1801. |_  No NSEC records found
  1802. | dns-nsec3-enum:
  1803. |_  DNSSEC NSEC3 not supported
  1804. | dns-nsid:
  1805. |_  bind.version: 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3
  1806. | vulscan: VulDB - https://vuldb.com:
  1807. | [93249] ISC BIND up to 9.8.x/9.9.9-P3/9.9.9-S5/9.10.4-P3/9.11.0 DNAME Response db.c denial of service
  1808. | [93015] ISC BIND up to 9.8.4/9.9.2 Packet Option DNS Packet Crash denial of service
  1809. | [80354] ISC BIND up to 9.8.8/9.9.8-P2/9.9.8-S3/9.10.3-P2 Address Prefix List apl_42.c denial of service
  1810. | [77552] ISC BIND up to 9.8.8/9.9.7-P2/9.10.2-P3 OpenPGP Key openpgpkey_61.c denial of service
  1811. | [77551] ISC BIND up to 9.8.8/9.9.7-P2/9.10.2-P3 DNSSEC Key buffer.c denial of service
  1812. | [13184] ISC BIND 9.8.1-P1 Smoothed Round Trip Time Algorithm DNS spoofing
  1813. | [9946] ISC BIND 9.8.1-P1 SRTT Algorithm privilege escalation
  1814. | [4443] ISC BIND up to 9.8.x Recursive Query Processor denial of service
  1815. | [57895] ISC BIND 9.8.0/9.8.1 Crash denial of service
  1816. | [4357] ISC BIND up to 9.8.x Negative Caching RRSIG RRsets denial of service
  1817. | [57404] ISC BIND 9.8.0 denial of service
  1818. | [135686] Bosch Smart Home Controller up to 9.8 Backup information disclosure
  1819. | [135684] Bosch Smart Home Controller up to 9.8 JSON-RPC Interface information disclosure
  1820. | [129940] Adobe Connect up to 9.8.1 Session Token information disclosure
  1821. | [117535] Synacor Zimbra Collaboration up to 8.6.0 Patch 9/8.7.11 Patch 2/8.8.7 mailboxd Error information disclosure
  1822. | [11371] Cisco ONS 15454 9.8.0 Controller Card denial of service
  1823. |
  1824. | MITRE CVE - https://cve.mitre.org:
  1825. | [CVE-2013-4854] The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
  1826. | [CVE-2013-3919] resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone.
  1827. | [CVE-2013-2266] libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.
  1828. | [CVE-2012-5689] ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.
  1829. | [CVE-2012-5688] ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
  1830. | [CVE-2012-5166] ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
  1831. | [CVE-2012-4244] ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record.
  1832. | [CVE-2012-1667] ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
  1833. | [CVE-2012-1033] The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
  1834. | [CVE-2011-4313] query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.
  1835. | [CVE-2011-2465] Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified query.
  1836. | [CVE-2011-2464] Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.
  1837. | [CVE-2011-1910] Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets.
  1838. | [CVE-2011-1907] ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.
  1839. | [CVE-2010-1567] The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.8(1)S5 allows remote attackers to cause a denial of service (device crash) via a malformed header, aka Bug ID CSCsz13590.
  1840. |
  1841. | SecurityFocus - https://www.securityfocus.com/bid/:
  1842. | [48264] Aastra 9480i CT Multiple Information Disclosure Vulnerabilities
  1843. | [61774] ISC BIND 9 SRTT Algorithm Authoritative Server Selection Security Vulnerability
  1844. | [61479] ISC BIND 9 DNS RDATA Handling CVE-2013-4854 Remote Denial of Service Vulnerability
  1845. | [58736] ISC BIND 9 'libdns' Remote Denial of Service Vulnerability
  1846. | [57556] ISC BIND 9 DNS64 CVE-2012-5689 Remote Denial of Service Vulnerability
  1847. | [56817] ISC BIND 9 DNS64 Remote Denial of Service Vulnerability
  1848. | [55852] ISC BIND 9 DNS RDATA Handling CVE-2012-5166 Remote Denial of Service Vulnerability
  1849. | [55522] ISC BIND 9 DNS Resource Records Handling CVE-2012-4244 Remote Denial of Service Vulnerability
  1850. | [54659] ISC BIND 9 TCP Query Remote Denial of Service Vulnerability
  1851. | [54658] ISC BIND 9 DNSSEC Validation CVE-2012-3817 Denial of Service Vulnerability
  1852. | [53772] ISC BIND 9 DNS Resource Records Handling Remote Denial of Service Vulnerability
  1853. | [50690] ISC BIND 9 Recursive Queries Remote Denial of Service Vulnerability
  1854. | [48566] ISC BIND 9 Unspecified Packet Processing Remote Denial of Service Vulnerability
  1855. | [48565] ISC BIND 9 RPZ Configurations Remote Denial of Service Vulnerabilities
  1856. | [48007] ISC BIND 9 Large RRSIG RRsets Remote Denial of Service Vulnerability
  1857. | [47734] ISC BIND 9 RRSIG Query Type Remote Denial of Service Vulnerability
  1858. | [46491] ISC BIND 9 IXFR Transfer/DDNS Update Remote Denial of Service Vulnerability
  1859. | [45385] ISC BIND 9 DNSSEC Validation Remote Denial of Service Vulnerability
  1860. | [45133] ISC BIND 9 'RRSIG' Record Type Negative Cache Remote Denial of Service Vulnerability
  1861. | [41730] ISC BIND 9 'RRSIG' Record Type Remote Denial of Service Vulnerability
  1862. | [37865] ISC BIND 9 DNSSEC Bogus NXDOMAIN Response Remote Cache Poisoning Vulnerability
  1863. | [37118] ISC BIND 9 DNSSEC Query Response Additional Section Remote Cache Poisoning Vulnerability
  1864. | [35848] ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
  1865. | [25076] ISC BIND 9 Default ACL Settings Recursive Queries And Cached Content Security Bypass Vulnerability
  1866. | [25037] ISC BIND 9 Remote Cache Poisoning Vulnerability
  1867. | [4936] ISC BIND 9 Remote Denial Of Service Vulnerability
  1868. |
  1869. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  1870. | [85799] Cisco Unified IP Phones 9900 Series directory traversal
  1871. | [75412] Cisco Unified IP Phones 9900 series RT privilege escalation
  1872. | [68733] Cisco 9000 Series Aggregation Service Router IPv4 packet denial of service
  1873. | [9704] Multiple Lucent router UDP port 9 could disclose sensitive information
  1874. | [9250] BIND 9 dns_message_findtype() denial of service
  1875. | [1852] BIND prior to 4.9.7 buffer overflow affects Digital Firewall 97 users
  1876. | [539] Microsoft Windows 95 and Internet Explorer password disclosure
  1877. | [86004] ISC BIND RDATA denial of service
  1878. | [84767] ISC BIND denial of service
  1879. | [83066] ISC BIND denial of service
  1880. | [81504] ISC BIND AAAA denial of service
  1881. | [80510] ISC BIND DNS64 denial of service
  1882. | [79121] ISC BIND queries denial of service
  1883. | [78479] ISC BIND RDATA denial of service
  1884. | [77185] ISC BIND TCP queries denial of service
  1885. | [77184] ISC BIND bad cache denial of service
  1886. | [76034] ISC BIND rdata denial of service
  1887. | [73053] ISC BIND cache update policy security bypass
  1888. | [71332] ISC BIND recursive queries denial of service
  1889. | [68375] ISC BIND UPDATE denial of service
  1890. | [68374] ISC BIND Response Policy Zones denial of service
  1891. | [67665] ISC BIND RRSIG Rrsets denial of service
  1892. | [67297] ISC BIND RRSIG denial of service
  1893. | [65554] ISC BIND IXFR transfer denial of service
  1894. | [63602] ISC BIND allow-query security bypass
  1895. | [63596] ISC BIND zone data security bypass
  1896. | [63595] ISC BIND RRSIG denial of service
  1897. | [62072] ISC BIND DNSSEC query denial of service
  1898. | [62071] ISC BIND ACL security bypass
  1899. | [61871] ISC BIND anchors denial of service
  1900. | [60421] ISC BIND RRSIG denial of service
  1901. | [56049] ISC BIND out-of-bailiwick weak security
  1902. | [55937] ISC Bind unspecified cache poisoning
  1903. | [55753] ISC BIND DNSSEC NSEC/NSEC3 cache poisoning
  1904. | [54416] ISC BIND DNSSEC cache poisoning
  1905. | [52073] ISC BIND dns_db_findrdataset() denial of service
  1906. | [47409] Multiple Mozilla products XBL loadBindingDocument information disclosure
  1907. | [45234] ISC BIND UDP denial of service
  1908. | [39670] ISC BIND inet_network buffer overflow
  1909. | [37233] libgssapi ISC BIND Novell SUSE Linux Enterprise Server GSS-TSIG request denial of service
  1910. | [37128] RHSA update for ISC BIND RRset denial of service not installed
  1911. | [37127] RHSA update for ISC BIND named service denial of service not installed
  1912. | [36275] ISC BIND DNS query spoofing
  1913. | [35575] ISC BIND query ID cache poisoning
  1914. | [35571] ISC BIND ACL security bypass
  1915. | [31838] ISC BIND RRset denial of service
  1916. | [31799] ISC BIND named service denial of service
  1917. | [29876] HP Tru64 ypbind core dump information disclosure
  1918. | [28745] ISC BIND DNSSEC RRset denial of service
  1919. | [28744] ISC BIND recursive INSIST denial of service
  1920. | [22041] BEA WebLogic Server and Express LDAP anonymous bind information disclosure
  1921. | [18836] BIND hostname disclosure
  1922. | [10624] ISC BIND DNS stub resolver library (libresolv.a) stack buffer overflows
  1923. | [10333] ISC BIND SIG null pointer dereference denial of service
  1924. | [10332] ISC BIND OPT resource record (RR) denial of service
  1925. | [10304] ISC BIND SIG cached resource records (RR) heap buffer overflow
  1926. | [7027] Cisco CBOS Web-based configuration utility binds to port 80 by default
  1927. | [5814] ISC BIND &quot
  1928. | [5540] ISC BIND can be remotely crashed by issuing ZXFR requests
  1929. | [5462] ISC BIND AXFR host command remote buffer overflow
  1930. |
  1931. | Exploit-DB - https://www.exploit-db.com:
  1932. | [17376] Aastra IP Phone 9480i Web Interface Data disclosure Vulnerability
  1933. | [9300] ISC BIND 9 Remote Dynamic Update Message Denial of Service PoC
  1934. |
  1935. | OpenVAS (Nessus) - http://www.openvas.org:
  1936. | [103090] ISC BIND 9 IXFR Transfer/DDNS Update Remote Denial of Service Vulnerability
  1937. | [103031] ISC BIND 9 < 9.7.2-P2 Multiple Vulnerabilities
  1938. | [103030] ISC BIND 9 'RRSIG' Record Type Negative Cache Remote Denial of Service Vulnerability
  1939. | [100717] ISC BIND 9 'RRSIG' Record Type Remote Denial of Service Vulnerability
  1940. | [100458] ISC BIND 9 DNSSEC Bogus NXDOMAIN Response Remote Cache Poisoning Vulnerability
  1941. | [100362] ISC BIND 9 DNSSEC Query Response Additional Section Remote Cache Poisoning Vulnerability
  1942. | [100251] ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
  1943. | [63208] Fedora Core 9 FEDORA-2009-0350 (bind)
  1944. | [11226] Oracle 9iAS default error information disclosure
  1945. |
  1946. | SecurityTracker - https://www.securitytracker.com:
  1947. | [1025811] Cisco ASR 9000 Series Router IPv4 Packet Processing Flaw Lets Remote Users Deny Service
  1948. | [1012995] BIND 9 Validator Assumption Error May Let Remote Users Deny Service
  1949. | [1005048] Oracle Enterprise Manager Web Service Component of Oracle 9i Application Server Discloses the Web Cache Administrator Password to Local Users
  1950. | [1003675] Oracle 9iAS Application Server Discloses CGI-BIN Script Source Code to Remote Users
  1951. | [1001186] Microsoft Windows Me Operating System and Windows 98 with the Plus! 98 Package Disclose Data Compression Passwords
  1952. | [1028901] (McAfee Issues Advisory for McAfee Email Gateway) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1953. | [1028900] (McAfee Issues Advisory for McAfee Email and Web Security Appliance) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1954. | [1028899] (McAfee Issues Fix for McAfee Web Gateway) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1955. | [1028866] (McAfee Issues Fix for McAfee Firewall Enterprise) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1956. | [1028854] (NetBSD Issues Fix) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1957. | [1028849] (Red Hat Issues Fix) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1958. | [1028848] (Red Hat Issues Fix) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1959. | [1028839] (FreeBSD Issues Fix) ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1960. | [1028838] ISC BIND RDATA Processing Bug Lets Remote Users Deny Service
  1961. | [1028632] ISC BIND RUNTIME_CHECK Error Lets Remote Users Deny Service Against Recursive Resolvers
  1962. | [1028046] ISC BIND DNS64 and Response Policy Zones (RPZ) Bug Lets Remote Users Deny Service
  1963. | [1027835] ISC BIND DNS64 Bug Lets Remote Users Deny Service
  1964. | [1027642] ISC BIND RDATA Processing Flaw Lets Remote Users Deny Service
  1965. | [1027529] ISC BIND RDATA Processing Flaw Lets Remote Users Deny Service
  1966. | [1026647] ISC BIND Cache Update Policy Can Be Bypassed to Allow Revoked Domain Names to Remain Resolvable
  1967. | [1026335] ISC BIND Invalid Record Caching Flaw Lets Remote Users Deny Service
  1968. | [1025743] ISC BIND Response Policy Zones DNAME/CNAME Processing Flaw Lets Remote Users Deny Service
  1969. | [1025742] ISC BIND Packet Processing Flaw Lets Remote Users Deny Service
  1970. | [1015850] Samba winbindd Daemon Discloses Server Password to Local Users
  1971. | [1003359] BindView NETinventory Discloses Password to Local Users During Auditing
  1972. | [1001721] BIND Domain Name System Software May Disclose DNS Transactional Signature (TSIG) Keys to Local Users
  1973. |
  1974. | OSVDB - http://www.osvdb.org:
  1975. | [72941] Aastra 9480i IP Phone Multiple Configuration File Direct Request Information Disclosure
  1976. |_
  1977. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1978. Aggressive OS guesses: Linux 2.6.32 (92%), Linux 2.6.32 - 3.10 (91%), Linux 2.6.32 - 3.9 (91%), Linux 3.2 (91%), Linux 2.6.32 - 3.13 (91%), Linux 3.1 (90%), Linux 2.6.32 - 2.6.39 (90%), Linux 2.6.32 - 3.1 (90%), Linux 2.6.39 (90%), Ubiquiti AirMax NanoStation WAP (Linux 2.6.32) (90%)
  1979. No exact OS matches for host (test conditions non-ideal).
  1980. Network Distance: 12 hops
  1981. Service Info: OS: Linux; CPE: cpe:/o:redhat:enterprise_linux:6
  1982.  
  1983. Host script results:
  1984. | dns-blacklist:
  1985. |   SPAM
  1986. |_    l2.apews.org - SPAM
  1987. | dns-brute:
  1988. |   DNS Brute-force hostnames:
  1989. |     www.fcomet.com - 108.178.4.46
  1990. |     internal.fcomet.com - 172.104.150.78
  1991. |     s3.fcomet.com - 173.236.22.162
  1992. |     smtp.fcomet.com - 208.91.198.143
  1993. |     smtp.fcomet.com - 208.91.199.223
  1994. |     smtp.fcomet.com - 208.91.199.224
  1995. |     smtp.fcomet.com - 208.91.199.225
  1996. |_    eshop.fcomet.com - 99.198.101.250
  1997.  
  1998. TRACEROUTE (using port 53/tcp)
  1999. HOP RTT       ADDRESS
  2000. 1   127.17 ms 10.231.200.1
  2001. 2   ...
  2002. 3   132.08 ms te0-0-2-1.nr11.b069785-0.tll01.atlas.cogentco.com (149.6.188.49)
  2003. 4   132.07 ms be2160.rcr51.tll01.atlas.cogentco.com (154.25.10.249)
  2004. 5   136.97 ms be3740.ccr21.sto03.atlas.cogentco.com (154.54.60.190)
  2005. 6   137.55 ms be3376.ccr21.sto01.atlas.cogentco.com (130.117.50.226)
  2006. 7   137.41 ms gtt-tinet.sto01.atlas.cogentco.com (130.117.15.138)
  2007. 8   254.05 ms xe-0-2-1.cr1-chi1.ip4.gtt.net (213.254.231.157)
  2008. 9   256.42 ms ip4.gtt.net (173.205.41.90)
  2009. 10  284.68 ms agg1.c13.r13.s101.chi03.singlehop.net (67.212.190.234)
  2010. 11  260.10 ms aswg1.c03.r13.s101.chi03.singlehop.net (67.212.183.194)
  2011. 12  258.14 ms s11.fcomet.com (184.154.7.82)
  2012. ######################################################################################################################################
  2013. HTTP/1.1 200 OK
  2014. Date: Tue, 19 Nov 2019 22:04:03 GMT
  2015. Server: Apache
  2016. Upgrade: h2,h2c
  2017. Connection: Upgrade
  2018. Last-Modified: Tue, 07 Aug 2018 09:11:39 GMT
  2019. Accept-Ranges: bytes
  2020. Content-Length: 163
  2021. Content-Type: text/html
  2022.  
  2023. Allow: OPTIONS,HEAD,GET,POST
  2024. ######################################################################################################################################
  2025. http://184.154.7.82 [200 OK] Apache, Country[UNITED STATES][US], HTTPServer[Apache], IP[184.154.7.82], Meta-Refresh-Redirect[/cgi-sys/defaultwebpage.cgi], UncommonHeaders[upgrade]
  2026. http://184.154.7.82/cgi-sys/defaultwebpage.cgi [200 OK] Apache, Country[UNITED STATES][US], Email[webmaster@184.154.7.82], HTML5, HTTPServer[Apache], IP[184.154.7.82], Title[Default Web Site Page], UncommonHeaders[upgrade]
  2027. ######################################################################################################################################
  2028. Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-19 17:07 EST
  2029. NSE: Loaded 163 scripts for scanning.
  2030. NSE: Script Pre-scanning.
  2031. Initiating NSE at 17:07
  2032. Completed NSE at 17:07, 0.00s elapsed
  2033. Initiating NSE at 17:07
  2034. Completed NSE at 17:07, 0.00s elapsed
  2035. Initiating Parallel DNS resolution of 1 host. at 17:07
  2036. Completed Parallel DNS resolution of 1 host. at 17:07, 0.02s elapsed
  2037. Initiating SYN Stealth Scan at 17:07
  2038. Scanning s11.fcomet.com (184.154.7.82) [1 port]
  2039. Discovered open port 80/tcp on 184.154.7.82
  2040. Completed SYN Stealth Scan at 17:07, 0.31s elapsed (1 total ports)
  2041. Initiating Service scan at 17:07
  2042. Scanning 1 service on s11.fcomet.com (184.154.7.82)
  2043. Completed Service scan at 17:07, 6.52s elapsed (1 service on 1 host)
  2044. Initiating OS detection (try #1) against s11.fcomet.com (184.154.7.82)
  2045. Retrying OS detection (try #2) against s11.fcomet.com (184.154.7.82)
  2046. Initiating Traceroute at 17:07
  2047. Completed Traceroute at 17:07, 3.16s elapsed
  2048. Initiating Parallel DNS resolution of 13 hosts. at 17:07
  2049. Completed Parallel DNS resolution of 13 hosts. at 17:07, 0.33s elapsed
  2050. NSE: Script scanning 184.154.7.82.
  2051. Initiating NSE at 17:07
  2052. Completed NSE at 17:08, 67.77s elapsed
  2053. Initiating NSE at 17:08
  2054. Completed NSE at 17:08, 1.03s elapsed
  2055. Nmap scan report for s11.fcomet.com (184.154.7.82)
  2056. Host is up (0.25s latency).
  2057.  
  2058. PORT   STATE SERVICE VERSION
  2059. 80/tcp open  http    Apache httpd
  2060. | http-brute:  
  2061. |_  Path "/" does not require authentication
  2062. |_http-chrono: Request times for /; avg: 815.34ms; min: 791.60ms; max: 868.77ms
  2063. |_http-csrf: Couldn't find any CSRF vulnerabilities.
  2064. |_http-date: Tue, 19 Nov 2019 22:07:29 GMT; -2s from local time.
  2065. |_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
  2066. |_http-dombased-xss: Couldn't find any DOM based XSS.
  2067. |_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
  2068. |_http-errors: Couldn't find any error pages.
  2069. |_http-feed: Couldn't find any feeds.
  2070. |_http-fetch: Please enter the complete path of the directory to save data in.
  2071. | http-headers:
  2072. |   Date: Tue, 19 Nov 2019 22:07:29 GMT
  2073. |   Server: Apache
  2074. |   Upgrade: h2,h2c
  2075. |   Connection: Upgrade, close
  2076. |   Last-Modified: Tue, 07 Aug 2018 09:11:39 GMT
  2077. |   Accept-Ranges: bytes
  2078. |   Content-Length: 163
  2079. |   Content-Type: text/html
  2080. |  
  2081. |_  (Request type: HEAD)
  2082. |_http-jsonp-detection: Couldn't find any JSONP endpoints.
  2083. | http-methods:
  2084. |_  Supported Methods: OPTIONS HEAD GET POST
  2085. |_http-mobileversion-checker: No mobile version detected.
  2086. | http-php-version: Logo query returned unknown hash f1fb042c62910c34be16ad91cbbd71fa
  2087. |_Credits query returned unknown hash f1fb042c62910c34be16ad91cbbd71fa
  2088. |_http-security-headers:
  2089. |_http-server-header: Apache
  2090. | http-sitemap-generator:
  2091. |   Directory structure:
  2092. |     /
  2093. |       Other: 1
  2094. |   Longest directory structure:
  2095. |     Depth: 0
  2096. |     Dir: /
  2097. |   Total files found (by extension):
  2098. |_    Other: 1
  2099. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
  2100. |_http-title: Site doesn't have a title (text/html).
  2101. | http-vhosts:
  2102. |_127 names had status 200
  2103. | http-waf-detect: IDS/IPS/WAF detected:
  2104. |_s11.fcomet.com:80/?p4yl04d3=<script>alert(document.cookie)</script>
  2105. |_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
  2106. |_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
  2107. |_http-xssed: No previously reported XSS vuln.
  2108. | vulscan: VulDB - https://vuldb.com:
  2109. | [141649] Apache OFBiz up to 16.11.05 Form Widget Freemarker Markup Code Execution
  2110. | [141648] Apache OFBiz up to 16.11.05 Application Stored cross site scripting
  2111. | [140386] Apache Commons Beanutils 1.9.2 BeanIntrospector unknown vulnerability
  2112. | [139708] Apache Ranger up to 1.2.0 Policy Import cross site scripting
  2113. | [139540] cPanel up to 60.0.24 Apache HTTP Server Key information disclosure
  2114. | [139386] Apache Tike up to 1.21 RecursiveParserWrapper Stack-based memory corruption
  2115. | [139385] Apache Tika 1.19/1.20/1.21 SAXParsers Hang denial of service
  2116. | [139384] Apache Tika up to 1.21 RecursiveParserWrapper ZIP File denial of service
  2117. | [139261] Apache Solr 8.2.0 DataImportHandler Parameter unknown vulnerability
  2118. | [139259] cPanel up to 68.0.26 WHM Apache Includes Editor information disclosure
  2119. | [139256] cPanel up to 68.0.26 WHM Apache Configuration Include Editor cross site scripting
  2120. | [139239] cPanel up to 70.0.22 Apache HTTP Server Log information disclosure
  2121. | [139141] Apache ActiveMQ Client up to 5.15.4 ActiveMQConnection.java ActiveMQConnection denial of service
  2122. | [139130] cPanel up to 73.x Apache HTTP Server Injection privilege escalation
  2123. | [138914] Venustech Apache VCL 2.1/2.2/2.3/2.4/2.5 VM sql injection
  2124. | [138913] Venustech Apache VCL 2.1/2.2/2.3/2.4/2.5 Block Argument privilege escalation
  2125. | [138912] Venustech Apache VCL 2.1/2.2/2.3/2.4/2.5 Cookie sql injection
  2126. | [138816] Apache Storm up to 1.2.2 Logviewer Daemon Log information disclosure
  2127. | [138815] Apache Storm up to 1.2.2 UI Daemon Deserialization privilege escalation
  2128. | [138164] Oracle 2.7.0.1 Apache Log4j unknown vulnerability
  2129. | [138155] Oracle Agile Engineering Data Management 6.2.0/6.2.1 Apache Tomcat unknown vulnerability
  2130. | [138151] Oracle Transportation Management 6.3.7 Apache Tomcat unknown vulnerability
  2131. | [138149] Oracle Agile Engineering Data Management 6.2.0/6.2.1 Apache Commons FileUpload unknown vulnerability
  2132. | [138131] Oracle MICROS Retail XBRi Loss Prevention 10.8.0/10.8.1/10.8.2/10.8.3 Apache Tomcat unknown vulnerability
  2133. | [138129] Oracle Retail Xstore Point of Service 7.0/7.1 Apache HTTP Server denial of service
  2134. | [138123] Oracle Retail Order Management System 5.0 Apache Struts 1 unknown vulnerability
  2135. | [138122] Oracle Retail Order Broker 5.2/15.0 Apache Tomcat unknown vulnerability
  2136. | [138121] Oracle Retail Order Broker 5.2/15.0 Apache CXF unknown vulnerability
  2137. | [138112] Oracle Retail Integration Bus 15.0/16.0 Apache Commons FileUpload unknown vulnerability
  2138. | [138111] Oracle MICROS Retail XBRi Loss Prevention 10.8.0/10.8.1/10.8.2/10.8.3 Apache Commons FileUpload unknown vulnerability
  2139. | [138103] Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56/8.57 Apache WSS4J information disclosure
  2140. | [138053] Oracle JD Edwards EnterpriseOne Tools 9.2 Apache Log4j unknown vulnerability
  2141. | [138036] Oracle Insurance Rules Palette 10.0/10.1/10.2/11.0 Apache Commons FileUpload unknown vulnerability
  2142. | [138035] Oracle Insurance Policy Administration J2EE 10.0/10.1/10.2/11.0 Apache Commons FileUpload unknown vulnerability
  2143. | [138034] Oracle Insurance Calculation Engine 9.7/10.0/10.1/10.2 Apache Commons FileUpload unknown vulnerability
  2144. | [138028] Oracle Identity Manager 11.1.2.3.0/12.2.1.3.0 Apache Log4j unknown vulnerability
  2145. | [138020] Oracle BI Publisher 11.1.1.9.0 Apache Tomcat unknown vulnerability
  2146. | [138019] Oracle BI Publisher (formerly XML Publisher) 11.1.1.9.0 Apache Tomcat unknown vulnerability
  2147. | [138017] Oracle Outside In Technology 8.5.4 Apache Commons FileUpload unknown vulnerability
  2148. | [138013] Oracle Outside In Technology 8.5.4 Apache Tomcat unknown vulnerability
  2149. | [138012] Oracle Outside In Technology 8.5.4 Apache HTTP Server unknown vulnerability
  2150. | [138009] Oracle Outside In Technology 8.5.4 Apache HTTP Server unknown vulnerability
  2151. | [138008] Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 Apache Struts 1 denial of service
  2152. | [138007] Oracle WebCenter Sites 12.2.1.3.0 Apache Tomcat denial of service
  2153. | [138006] Oracle Enterprise Repository 12.1.3.0.0 Apache CXF denial of service
  2154. | [138000] Oracle WebCenter Sites 12.2.1.3.0 Apache Commons FileUpload unknown vulnerability
  2155. | [137999] Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 Apache Commons FileUpload unknown vulnerability
  2156. | [137995] Oracle Hospitality Simphony 18.2.1 Apache WSS4J information disclosure
  2157. | [137987] Oracle FLEXCUBE Universal Banking up to 12.0.3/12.4.0/14.2.0 Apache Log4j unknown vulnerability
  2158. | [137981] Oracle Insurance IFRS 17 Analyzer 8.0.6/8.0.7 Apache Commons FileUpload unknown vulnerability
  2159. | [137980] Oracle Insurance Data Foundation 8.0.4/8.0.5/8.0.6/8.0.7 Apache Commons FileUpload unknown vulnerability
  2160. | [137979] Oracle 8.0.8 Apache Commons FileUpload unknown vulnerability
  2161. | [137973] Oracle 8.0.4/8.0.5/8.0.6/8.0.7 Apache Batik unknown vulnerability
  2162. | [137970] Oracle Financial Services Profitability Management 8.0.4/8.0.5/8.0.6/8.0.7 Apache ActiveMQ unknown vulnerability
  2163. | [137967] Oracle up to 8.0.7 Apache httpd unknown vulnerability
  2164. | [137966] Oracle 8.0.7/8.0.8 Apache Groovy unknown vulnerability
  2165. | [137965] Oracle Financial Services Liquidity Risk Management 8.0.1/8.0.2/8.0.4/8.0.5/8.0.6 Apache Commons FileUpload unknown vulnerability
  2166. | [137964] Oracle 8.0.4/8.0.5/8.0.6/8.0.7 Apache Log4j unknown vulnerability
  2167. | [137933] Oracle Banking Platform up to 2.7.1 Apache Tika unknown vulnerability
  2168. | [137926] Oracle Enterprise Manager for Fusion Middleware 13.2/13.3 Apache Commons FileUpload information disclosure
  2169. | [137924] Oracle Enterprise Manager Base Platform 12.1.0.5.0/13.2.0.0.0/13.3.0.0.0 Apache Commons FileUpload unknown vulnerability
  2170. | [137914] Oracle E-Business Suite up to 12.2.8 Apache ActiveMQ unknown vulnerability
  2171. | [137913] Oracle E-Business Suite up to 12.2.8 Apache ActiveMQ unknown vulnerability
  2172. | [137911] Oracle E-Business Suite up to 12.2.8 Apache HTTP Server unknown vulnerability
  2173. | [137910] Oracle E-Business Suite up to 12.2.8 Apache CXF information disclosure
  2174. | [137909] Oracle E-Business Suite up to 12.2.8 Apache Commons FileUpload unknown vulnerability
  2175. | [137905] Oracle Primavera Gateway 15.2/16.2/17.12/18.8 Apache Tika denial of service
  2176. | [137901] Oracle Primavera Unifier up to 18.8 Apache HTTP Server unknown vulnerability
  2177. | [137895] Oracle Instant Messaging Server 10.0.1.2.0 Apache Tika information disclosure
  2178. | [137894] Oracle EAGLE (Software) 46.5/46.6/46.7 Apache Tomcat information disclosure
  2179. | [137892] Oracle Online Mediation Controller 6.1 Apache Batik denial of service
  2180. | [137891] Oracle Interactive Session Recorder 6.0/6.1/6.2 Apache Tomcat unknown vulnerability
  2181. | [137885] Oracle Diameter Signaling Router (DSR) 8.0/8.1/8.2 Apache cxf unknown vulnerability
  2182. | [137882] Oracle Unified 8.0.0.2.0 Apache Commons FileUpload unknown vulnerability
  2183. | [137881] Oracle Online Mediation Controller 6.1 Apache Commons FileUpload unknown vulnerability
  2184. | [137880] Oracle Interactive Session Recorder 6.0/6.1/6.2 Apache Log4j unknown vulnerability
  2185. | [137879] Oracle Convergence 3.0.2 Apache Commons FileUpload unknown vulnerability
  2186. | [137876] Oracle Application Session Controller 3.7.1/3.8.0 Apache Commons FileUpload unknown vulnerability
  2187. | [137829] Apache Roller 5.2.3 Math Comment Authenticator Reflected cross site scripting
  2188. | [137736] Apache Kafka 0.11.0.0/2.1.0 ACL Validation Request privilege escalation
  2189. | [136858] MakerBot Replicator 5G Printer Apache HTTP Server information disclosure
  2190. | [136849] Analogic Poste.io 2.1.6 on Apache RoundCube logs/ information disclosure
  2191. | [136822] Apache Tomcat up to 8.5.40/9.0.19 Incomplete Fix CVE-2019-0199 Resource Exhaustion denial of service
  2192. | [136808] Apache Geode up to 1.8.0 Secure Mode privilege escalation
  2193. | [136646] Apache Allura up to 1.10.x Dropdown Selector Stored cross site scripting
  2194. | [136374] Apache HTTP Server up to 2.4.38 Slash Regular Expression unknown vulnerability
  2195. | [136373] Apache HTTP Server 2.4.34/2.4.35/2.4.36/2.4.37/2.4.38 HTTP2 Request Crash denial of service
  2196. | [136372] Apache HTTP Server up to 2.4.38 HTTP2 Request unknown vulnerability
  2197. | [136370] Apache Fineract up to 1.2.x sql injection
  2198. | [136369] Apache Fineract up to 1.2.x sql injection
  2199. | [135731] Apache Hadoop up to 2.8.4/2.9.1/3.1.0 yarn privilege escalation
  2200. | [135664] Apache Tomcat up to 7.0.93/8.5.39/9.0.0.17 SSI printenv Command cross site scripting
  2201. | [135663] Apache Camel up to 2.23.x JSON-lib Library XML Data XML External Entity
  2202. | [135661] Apache Roller up to 5.2.1/5.2.0 XML-RPC Interface XML File Server-Side Request Forgery
  2203. | [135402] Apache Zookeeper up to 3.4.13/3.5.0-alpha to 3.5.4-beta getACL() information disclosure
  2204. | [135270] Apache JSPWiki up to 2.11.0.M3 Plugin Link cross site scripting
  2205. | [135269] Apache JSPWiki up to 2.11.0.M3 InterWiki Link cross site scripting
  2206. | [135268] Apache JSPWiki up to 2.11.0.M3 Attachment cross site scripting
  2207. | [134527] Apache Karaf up to 4.2.4 Config Service directory traversal
  2208. | [134416] Apache Sanselan 0.97-incubator Loop denial of service
  2209. | [134415] Apache Sanselan 0.97-incubator Hang denial of service
  2210. | [134291] Apache Axis up to 1.7.8 Server-Side Request Forgery
  2211. | [134290] Apache UIMA DUCC up to 2.2.2 cross site scripting
  2212. | [134248] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
  2213. | [134247] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
  2214. | [134246] Apache Camel up to 2.19/2.21.3/2.22.2/2.23.0 directory traversal
  2215. | [134138] Apache Pluto 3.0.0/3.0.1 Chat Room Demo Portlet cross site scripting
  2216. | [133992] Apache Qpid Proton up to 0.27.0 Certificate Validation Man-in-the-Middle weak authentication
  2217. | [133977] Apache Zeppelin up to 0.7.x Stored cross site scripting
  2218. | [133976] Apache Zeppelin up to 0.7.x Cron Scheduler privilege escalation
  2219. | [133975] Apache Zeppelin up to 0.7.2 Session Fixation weak authentication
  2220. | [133444] Apache PDFbox 2.0.14 XML Parser XML External Entity
  2221. | [133573] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache ActiveMQ unknown vulnerability
  2222. | [133407] Apache Tomcat up to 7.0.93/8.5.39/9.0.17 on Windows JRE Command Line Argument Code Execution
  2223. | [133315] Apache Airflow up to 1.10.2 HTTP Endpoint cross site request forgery
  2224. | [133314] Apache Airflow up to 1.10.2 Metadata Database cross site scripting
  2225. | [133290] Apache Tomcat up to 8.5.37/9.0.14 HTTP2 Stream Execution denial of service
  2226. | [133112] Apache HTTP Server up to 2.4.38 mod_auth_digest race condition privilege escalation
  2227. | [133111] Apache HTTP Server 2.4.37/2.4.38 mod_ssl Bypass privilege escalation
  2228. | [133092] Airsonic 10.2.1 org.apache.commons.lang.RandomStringUtils RecoverController.java java.util.Random weak authentication
  2229. | [132568] Apache JSPWiki up to 2.11.0.M2 URL User information disclosure
  2230. | [132567] Apache JSPWiki up to 2.11.0.M2 URL cross site scripting
  2231. | [132566] Apache ActiveMQ up to 5.15.8 MQTT Frame Memory denial of service
  2232. | [132565] Apache HBase up to 2.1.3 REST Server Request privilege escalation
  2233. | [132183] Apache Mesos up to pre-1.4.x Docker Image Code Execution
  2234. | [131988] Apache Karaf up to 4.2.2 kar Deployer directory traversal
  2235. | [131859] Apache Hadoop up to 2.9.1 privilege escalation
  2236. | [131479] Apache Solr up to 7.6 HTTP GET Request Server-Side Request Forgery
  2237. | [131446] Apache Solr up to 5.0.5/6.6.5 Config API HTTP POST Request Code Execution
  2238. | [131385] Apache Qpid Broker-J up to 6.x/7.0.6/7.1.0 AMQP Command Crash denial of service
  2239. | [131315] Apache Mesos up to pre-1.4.x Mesos Masters Rendering JSON Payload Recursion denial of service
  2240. | [131236] Apache Airflow up to 1.10.1 Metadata Database cross site scripting
  2241. | [130755] Apache JSPWiki up to 2.10.5 URL cross site scripting
  2242. | [130629] Apache Guacamole Cookie Flag weak encryption
  2243. | [130628] Apache Hadoop up to 3.0.0 HDFS information disclosure
  2244. | [130529] Apache Subversion 1.10.0/1.10.1/1.10.2/1.10.3/1.11.0 mod_dav_svn Directory Crash denial of service
  2245. | [130353] Apache Open Office up to 4.1.5 Document Loader String memory corruption
  2246. | [130341] Apache HTTP Server 2.4.37 mod_ssl Loop denial of service
  2247. | [130330] Apache HTTP Server up to 2.4.37 mod_session Expired privilege escalation
  2248. | [130329] Apache HTTP Server 2.4.37 mod_http2 Slowloris denial of service
  2249. | [130212] Apache Airflow up to 1.10.0 LDAP Auth Backend Certificate weak authentication
  2250. | [130123] Apache Airflow up to 1.8.2 information disclosure
  2251. | [130122] Apache Airflow up to 1.8.2 command injection cross site request forgery
  2252. | [130121] Apache Airflow up to 1.8.2 Webserver Object Code Execution
  2253. | [129717] Oracle Secure Global Desktop 5.4 Apache HTTP Server denial of service
  2254. | [129688] Oracle Tape Library ACSLS 8.4 Apache Log4j unknown vulnerability
  2255. | [129673] Oracle Retail Returns Management 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
  2256. | [129672] Oracle Retail Central Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
  2257. | [129671] Oracle Retail Back Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
  2258. | [129574] Oracle Outside In Technology 8.5.3/8.5.4 Apache Tomcat denial of service
  2259. | [129573] Oracle WebLogic Server 10.3.6.0 Apache HTTP Server denial of service
  2260. | [129563] Oracle Enterprise Repository 12.1.3.0.0 Apache Log4j unknown vulnerability
  2261. | [129555] Oracle Outside In Technology 8.5.3 Apache Batik denial of service
  2262. | [129551] Oracle Outside In Technology 8.5.3/8.5.4 Apache Commons FileUpload denial of service
  2263. | [129542] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
  2264. | [129538] Oracle SOA Suite 12.1.3.0.0/12.2.1.3.0 Apache Batik unknown vulnerability
  2265. | [129519] Oracle Enterprise Manager Ops Center 12.2.2/12.3.3 Apache ActiveMQ unknown vulnerability
  2266. | [129508] Oracle Applications Manager up to 12.2.8 Apache Derby unknown vulnerability
  2267. | [129507] Oracle Mobile Field Service up to 12.2.8 Apache Log4j unknown vulnerability
  2268. | [129505] Oracle Email Center up to 12.2.8 Apache Log4j unknown vulnerability
  2269. | [129504] Oracle CRM Technical Foundation up to 12.2.8 Apache Commons FileUpload unknown vulnerability
  2270. | [129499] Oracle Partner Management up to 12.2.8 Apache Log4j unknown vulnerability
  2271. | [129498] Oracle Marketing up to 12.2.8 Apache Commons FileUpload unknown vulnerability
  2272. | [129480] Oracle Communications WebRTC Session Controller up to 7.1 Apache Batik unknown vulnerability
  2273. | [129479] Oracle Communications Diameter Signaling Router up to 8.2 Apache Batik unknown vulnerability
  2274. | [129474] Oracle Communications Diameter Signaling Router up to 8.2 Apache HTTP Server information disclosure
  2275. | [129472] Oracle Communications WebRTC Session Controller up to 7.1 Apache Struts 1 unknown vulnerability
  2276. | [129470] Oracle Communications Converged Application Server up to 7.0.0.0 Apache Struts 1 unknown vulnerability
  2277. | [129463] Oracle Communications WebRTC Session Controller up to 7.1 Apache Log4j unknown vulnerability
  2278. | [129461] Oracle Communications Services Gatekeeper up to 6.1.0.3.x Apache Commons Collections Fileupload unknown vulnerability
  2279. | [129460] Oracle Communications Service Broker 6.0 Apache Log4j unknown vulnerability
  2280. | [129459] Oracle Communications Policy Management up to 12.4 Apache Struts 2 unknown vulnerability
  2281. | [129458] Oracle Communications Online Mediation Controller 6.1 Apache Log4j unknown vulnerability
  2282. | [129457] Oracle Communications Diameter Signaling Router up to 8.2 Apache Commons Fileupload unknown vulnerability
  2283. | [129456] Oracle Communications Converged Application Server 6.1 Apache Log4j unknown vulnerability
  2284. | [128714] Apache Thrift Java Client Library up to 0.11.0 SASL Negotiation org.apache.thrift.transport.TSaslTransport unknown vulnerability
  2285. | [128713] Apache Thrift Node.js Static Web Server up to 0.11.0 directory traversal
  2286. | [128709] Apache Karaf up to 4.1.6/4.2.1 Features Deployer XMLInputFactory XML External Entity
  2287. | [128575] Apache NetBeans 9.0 Proxy Auto-Config Code Execution
  2288. | [128369] Apache Tika 1.8-1.19.1 SQLite3Parser Loop sql injection
  2289. | [128111] Apache NiFi 1.8.0 Template Upload Man-in-the-Middle cross site request forgery
  2290. | [128110] Apache NiFi 1.8.0 Cluster Request privilege escalation
  2291. | [128109] Apache NiFi 1.8.0 Error Page message-page.jsp Request Header cross site scripting
  2292. | [128108] Apache NiFi up to 1.7.x X-Frame-Options Header privilege escalation
  2293. | [128102] Apache Oozie up to 5.0.0 Workflow XML Impersonation spoofing
  2294. | [127994] WordPress up to 5.0.0 on Apache httpd MIME Restriction cross site scripting
  2295. | [127981] Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04 HTTP Engine httpService GET Request privilege escalation
  2296. | [127161] Apache Hadoop 2.7.4/2.7.5/2.7.6 Incomplete Fix CVE-2016-6811 privilege escalation
  2297. | [127040] Loadbalancer.org Enterprise VA MAX up to 8.3.2 Apache HTTP Server Log cross site scripting
  2298. | [127007] Apache Spark Request Code Execution
  2299. | [126791] Apache Hadoop up to 0.23.11/2.7.6/2.8.4/2.9.1/3.0.2 ZIP File unknown vulnerability
  2300. | [126767] Apache Qpid Proton-J Transport 0.3 Certificate Verification Man-in-the-Middle weak authentication
  2301. | [126896] Apache Commons FileUpload 1.3.3 on LDAP Manager DiskFileItem File privilege escalation
  2302. | [126574] Apache Hive up to 2.3.3/3.1.0 Query privilege escalation
  2303. | [126573] Apache Hive up to 2.3.3/3.1.0 HiveServer2 privilege escalation
  2304. | [126564] Apache Superset up to 0.22 Pickle Library load Code Execution
  2305. | [126488] Apache Syncope up to 2.0.10/2.1.1 BPMN Definition xxe privilege escalation
  2306. | [126487] Apache Syncope up to 2.0.10/2.1.1 cross site scripting
  2307. | [126346] Apache Tomcat Path privilege escalation
  2308. | [125922] Apache Impala up to 3.0.0 ALTER privilege escalation
  2309. | [125921] Apache Impala up to 3.0.0 Queue Injection privilege escalation
  2310. | [125647] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Install (Apache Tomcat) information disclosure
  2311. | [125617] Oracle Retail Returns Management 14.1 Apache Batik unknown vulnerability
  2312. | [125616] Oracle Retail Point-of-Service 13.4/14.0/14.1 Apache Batik unknown vulnerability
  2313. | [125614] Oracle Retail Central Office 14.1 Apache Batik unknown vulnerability
  2314. | [125613] Oracle Retail Back Office 13.3/13.4/14/14.1 Apache Batik unknown vulnerability
  2315. | [125599] Oracle Retail Open Commerce Platform 5.3.0/6.0.0/6.0.1 Apache Log4j unknown vulnerability
  2316. | [125569] Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56 Apache HTTP Server information disclosure
  2317. | [125494] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat information disclosure
  2318. | [125447] Oracle Business Intelligence Enterprise Edition 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Batik unknown vulnerability
  2319. | [125428] Oracle Identity Management Suite 11.1.2.3.0/12.2.1.3.0 Apache Log4j unknown vulnerability
  2320. | [125427] Oracle Identity Analytics 11.1.1.5.8 Apache Log4j unknown vulnerability
  2321. | [125424] Oracle API Gateway 11.1.2.4.0 Apache Log4j unknown vulnerability
  2322. | [125423] Oracle BI Publisher 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Log4j unknown vulnerability
  2323. | [125383] Oracle up to  10.2.0 Apache Trinidad unknown vulnerability
  2324. | [125379] Oracle up to  10.1.x Apache Struts 1 cross site scripting
  2325. | [125377] Oracle up to  10.2.0 Apache Commons Collections unknown vulnerability
  2326. | [125376] Oracle Communications Application Session Controller up to  3.7.0 Apache Commons Collections unknown vulnerability
  2327. | [125375] Oracle Communications User Data Repository up to  12.1.x Apache Xerces memory corruption
  2328. | [125248] Apache ActiveMQ up to 5.15.5 Web-based Administration Console queue.jsp Parameter cross site scripting
  2329. | [125133] Apache Tika up to 1.19 XML Parser reset() denial of service
  2330. | [124877] Apache PDFbox up to 2.0.11 PDF File denial of service
  2331. | [124876] Apache Ranger up to 1.1.x UnixAuthenticationService Stack-based memory corruption
  2332. | [124791] Apache Tomcat up to 7.0.90/8.5.33/9.0.11 URL Open Redirect
  2333. | [124787] Apache Pony Mail 0.7/0.8/0.9 Statistics Generator Timestamp Data information disclosure
  2334. | [124447] Apache HTTP Server up to 2.4.34 SETTINGS Frame denial of service
  2335. | [124346] Apache Mesos pre-1.4.2/1.5.0/1.5.1/1.6.0 on Executor HTTP API String Comparison validation JSON Web Token information disclosure
  2336. | [124286] Apache Tika up to 1.18 IptcAnpaParser Loop denial of service
  2337. | [124242] Apache Tika up to 0.18 C:/evil.bat" Directory unknown vulnerability
  2338. | [124241] Apache Tika up to 0.18 XML Parser Entity Expansion denial of service
  2339. | [124191] Apache Karaf up to 3.0.8/4.0.8/4.1.0 WebConsole .../gogo/ weak authentication
  2340. | [124190] Apache Karaf up to 4.1.x sshd privilege escalation
  2341. | [124152] Apache Camel Mail up to 2.22.0 Path directory traversal
  2342. | [124143] Apache SpamAssassin up to 3.4.1 PDFInfo Plugin Code Execution
  2343. | [124134] Apache SpamAssassin up to 3.4.1 Scan Engine HTML::Parser Email denial of service
  2344. | [124095] PHP up to 5.6.37/7.0.31/7.1.21/7.2.9 Apache2 sapi_apache2.c php_handler cross site scripting
  2345. | [124024] Apache Mesos 1.4.x/1.5.0 libprocess JSON Payload denial of service
  2346. | [123814] Apache ActiveMQ Client up to 5.15.5 TLS Hostname Verification Man-in-the-Middle weak authentication
  2347. | [123393] Apache Traffic Server up to 6.2.2/7.1.3 ESI Plugin Config privilege escalation
  2348. | [123392] Apache Traffic Server 6.2.2 TLS Handshake Segmentation Fault denial of service
  2349. | [123391] Apache Traffic Server up to 6.2.2/7.1.3 Range Request Performance denial of service
  2350. | [123390] Apache Traffic Server up to 6.2.2/7.1.3 Request HTTP Smuggling privilege escalation
  2351. | [123369] Apache Traffic Server up to 6.2.2/7.1.3 ACL remap.config Request denial of service
  2352. | [123197] Apache Sentry up to 2.0.0 privilege escalation
  2353. | [123145] Apache Struts up to 2.3.34/2.5.16 Namespace Code Execution
  2354. | [123144] Apache Cayenne up to 4.1.M1 CayenneModeler XML File File Transfer privilege escalation
  2355. | [122981] Apache Commons Compress 1.7 ZipArchiveInputStream ZIP Archive denial of service
  2356. | [122889] Apache HTTP Server up to 2.2.31/2.4.23 mod_userdir HTTP Response Splitting privilege escalation
  2357. | [122800] Apache Spark 1.3.0 REST API weak authentication
  2358. | [122642] Apache Airflow up to 1.8.x 404 Page Reflected cross site scripting
  2359. | [122568] Apache Tomcat up to 8.5.31/9.0.9 Connection Reuse weak authentication
  2360. | [122567] Apache Axis 1.0./1.1/1.2/1.3/1.4 cross site scripting
  2361. | [122556] Apache Tomcat up to 7.0.86/8.0.51/8.5.30/9.0.7 UTF-8 Decoder Loop denial of service
  2362. | [122531] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.9 WebSocket Client unknown vulnerability
  2363. | [122456] Apache Camel up to 2.20.3/2.21.0 XSD Validator XML External Entity
  2364. | [122455] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Revoked Certificate weak authentication
  2365. | [122454] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Responder Revoked Certificate weak authentication
  2366. | [122214] Apache Kafka up to 0.9.0.1/0.10.2.1/0.11.0.2/1.0.0 Broker Request Data Loss denial of service
  2367. | [122202] Apache Kafka up to 0.10.2.1/0.11.0.1 SASL Impersonation spoofing
  2368. | [122101] Docker Skeleton Runtime for Apache OpenWhisk Docker Action dockerskeleton:1.3.0 privilege escalation
  2369. | [122100] PHP Runtime for Apache OpenWhisk Docker Action action-php-v7.2:1.0.0 privilege escalation
  2370. | [122012] Apache Ignite up to 2.5 Serialization privilege escalation
  2371. | [121911] Apache Ambari up to 2.5.x/2.6.2 Log Message Credentials information disclosure
  2372. | [121910] Apache HTTP Server 2.4.33 mod_md HTTP Requests denial of service
  2373. | [121854] Oracle Tape Library ACSLS up to ACSLS 8.4.0-2 Apache Commons Collections unknown vulnerability
  2374. | [121752] Oracle Insurance Policy Administration 10.0/10.1/10.2/11.0 Apache Log4j unknown vulnerability
  2375. | [121370] Apache Spark up to 2.1.2/2.2.1/2.3.0 URL cross site scripting
  2376. | [121354] Apache CouchDB HTTP API Code Execution
  2377. | [121144] Apache LDAP API up to 1.0.1 SSL Filter information disclosure
  2378. | [121143] Apache Storm up to 0.10.2/1.0.6/1.1.2/1.2.1 Cluster privilege escalation
  2379. | [120436] Apache CXF Fediz up to 1.4.3 Application Plugin unknown vulnerability
  2380. | [120310] Apache PDFbox up to 1.8.14/2.0.10 AFMParser Loop denial of service
  2381. | [120168] Apache CXF weak authentication
  2382. | [120080] Apache Cassandra up to 3.11.1 JMX/RMI Interface RMI Request privilege escalation
  2383. | [120043] Apache HBase up to 1.2.6.0/1.3.2.0/1.4.4/2.0.0 Thrift 1 API Server weak authentication
  2384. | [119723] Apache Qpid Broker-J 7.0.0/7.0.1/7.0.2/7.0.3/7.0.4 AMQP Messages Crash denial of service
  2385. | [122569] Apache HTTP Server up to 2.4.33 HTTP2 Request denial of service
  2386. | [119486] Apache Geode up to 1.4.0 Security Manager Code Execution
  2387. | [119306] Apache MXNet Network Interface privilege escalation
  2388. | [118999] Apache Storm up to 1.0.6/1.1.2/1.2.1 Archive directory traversal
  2389. | [118996] Apache Storm up to 1.0.6/1.1.2/1.2.1 Daemon spoofing
  2390. | [118644] Apple macOS up to 10.13.5 apache_mod_php unknown vulnerability
  2391. | [118200] Apache Batik up to 1.9 Deserialization unknown vulnerability
  2392. | [118143] Apache NiFi activemq-client Library Deserialization denial of service
  2393. | [118142] Apache NiFi 1.6.0 SplitXML xxe privilege escalation
  2394. | [118051] Apache Zookeeper up to 3.4.9/3.5.3-beta weak authentication
  2395. | [117997] Apache ORC up to 1.4.3 ORC File Recursion denial of service
  2396. | [117825] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.8 CORS Filter privilege escalation
  2397. | [117405] Apache Derby up to 10.14.1.0 Network Server Network Packet privilege escalation
  2398. | [117347] Apache Ambari up to 2.6.1 HTTP Request directory traversal
  2399. | [117265] LibreOffice/Apache Office Writer SMB Connection XML Document information disclosure
  2400. | [117143] Apache uimaj/uima-as/uimaFIT/uimaDUCC XML XXE information disclosure
  2401. | [117117] Apache Tika up to 1.17 ChmParser Loop denial of service
  2402. | [117116] Apache Tika up to 1.17 BPGParser Loop denial of service
  2403. | [117115] Apache Tika up to 1.17 tika-server command injection
  2404. | [116929] Apache Fineract getReportType Parameter privilege escalation
  2405. | [116928] Apache Fineract REST Endpoint Parameter privilege escalation
  2406. | [116927] Apache Fineract MakercheckersApiResource Parameter sql injection
  2407. | [116926] Apache Fineract REST Parameter privilege escalation
  2408. | [116574] Apache wicket-jquery-ui up to 6.29.0/7.10.1/8.0.0-M9.1 WYSIWYG Editor privilege escalation
  2409. | [116622] Oracle Enterprise Manager for MySQL Database 12.1.0.4 EM Plugin: General (Apache Tomcat) unknown vulnerability
  2410. | [115931] Apache Solr up to 6.6.2/7.2.1 XML Data Parameter XML External Entity
  2411. | [115883] Apache Hive up to 2.3.2 privilege escalation
  2412. | [115882] Apache Hive up to 2.3.2 xpath_short information disclosure
  2413. | [115881] Apache DriverHive JDBC Driver up to 2.3.2 Escape Argument Bypass privilege escalation
  2414. | [115518] Apache Ignite 2.3 Deserialization privilege escalation
  2415. | [115260] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache cross site scripting
  2416. | [115259] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache Cookie Stack-based memory corruption
  2417. | [115500] CA Workload Control Center up to r11.4 SP5 Apache MyFaces Component Code Execution
  2418. | [115121] Apache Struts REST Plugin up to 2.5.15 Xstream XML Data denial of service
  2419. | [115061] Apache HTTP Server up to 2.4.29 HTTP Digest Authentication Challenge HTTP Requests Replay privilege escalation
  2420. | [115060] Apache HTTP Server up to 2.4.29 mod_cache_socache Request Header Crash denial of service
  2421. | [115059] Apache HTTP Server up to 2.4.29 HTTP2 NULL Pointer Dereference denial of service
  2422. | [115058] Apache HTTP Server up to 2.4.29 HTTP Header Crash denial of service
  2423. | [115057] Apache HTTP Server up to 2.4.29 mod_session Variable Name Cache privilege escalation
  2424. | [115039] Apache HTTP Server up to 2.4.29 FilesMatch File Upload privilege escalation
  2425. | [115038] Apache HTTP Server up to 2.0.65/2.2.34/2.4.29 mod_authnz_ldap Crash denial of service
  2426. | [114817] Apache Syncope up to 1.2.10/2.0.7 Search Parameter information disclosure
  2427. | [114816] Apache Syncope up to 1.2.10/2.0.7 XSLT Code Execution
  2428. | [114717] Apache Commons 1.11/1.12/1.13/1.14/1.15 ZIP Archive ZipFile/ZipArchiveInputStream denial of service
  2429. | [114661] Apache Allura up to 1.8.0 HTTP Response Splitting privilege escalation
  2430. | [114400] Apache Tomcat JK ISAPI Connector up to 1.2.42 IIS/ISAPI privilege escalation
  2431. | [114258] Apache HTTP Server up to 2.4.22 mod_cluster Segmentation Fault denial of service
  2432. | [114086] Apache ODE 1.3.3 ODE Process Deployment Web Service directory traversal
  2433. | [113955] Apache Xerces-C up to 3.2.0 XML Parser NULL Pointer Dereference denial of service
  2434. | [113945] Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String privilege escalation
  2435. | [113944] Apache OpenMeetings up to 3.x/4.0.1 CRUD Operation denial of service
  2436. | [113905] Apache Traffic Server up to 5.2.x/5.3.2/6.2.0/7.0.0 TLS Handshake Core Dump denial of service
  2437. | [113904] Apache Traffic Server up to 6.2.0 Host Header privilege escalation
  2438. | [113895] Apache Geode up to 1.3.x Code Execution
  2439. | [113894] Apache Geode up to 1.3.x TcpServer Code Execution
  2440. | [113888] Apache James Hupa WebMail 0.0.2 cross site scripting
  2441. | [113813] Apache Geode Cluster up to 1.3.x Secure Mode privilege escalation
  2442. | [113747] Apache Tomcat Servlets privilege escalation
  2443. | [113647] Apache Qpid up to 0.30 qpidd Broker AMQP Message Crash denial of service
  2444. | [113645] Apache VCL up to 2.1/2.2.1/2.3.1 Web GUI/XMLRPC API privilege escalation
  2445. | [113560] Apache jUDDI Console 3.0.0 Log Entries spoofing
  2446. | [113571] Apache Oozie up to 4.3.0/5.0.0-beta1 XML Data XML File privilege escalation
  2447. | [113569] Apache Karaf up to 4.0.7 LDAPLoginModule LDAP injection denial of service
  2448. | [113273] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
  2449. | [113198] Apache Qpid Dispatch Router 0.7.0/0.8.0 AMQP denial of service
  2450. | [113186] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
  2451. | [113145] Apache Thrift up to 0.9.3 Go Client Library privilege escalation
  2452. | [113106] Apache jUDDI up to 3.3.3 XML Data WADL2Java/WSDL2Java XML Document privilege escalation
  2453. | [113105] Apache Qpid Broker-J 7.0.0 AMQP Crash denial of service
  2454. | [112885] Apache Allura up to 1.8.0 File information disclosure
  2455. | [112856] Apache CloudStack up to 4.8.1.0/4.9.0.0 API weak authentication
  2456. | [112855] Apache CloudStack 4.1.0/4.1.1 API information disclosure
  2457. | [112678] Apache Tomcat up to 7.0.82/8.0.47/8.5.23/9.0.1 Bug Fix 61201 privilege escalation
  2458. | [112677] Apache Tomcat Native Connector up to 1.1.34/1.2.14 OCSP Checker Client weak authentication
  2459. | [112625] Apache POI up to 3.16 Loop denial of service
  2460. | [112448] Apache NiFi up to 1.3.x Deserialization privilege escalation
  2461. | [112396] Apache Hadoop 2.7.3/2.7.4 YARN NodeManager Credentials information disclosure
  2462. | [112339] Apache NiFi 1.5.0 Header privilege escalation
  2463. | [112330] Apache NiFi 1.5.0 Header HTTP Request privilege escalation
  2464. | [112314] NetGain Enterprise Manager 7.2.730 Build 1034 org.apache.jsp.u.jsp.tools.exec_jsp Servlet Parameter privilege escalation
  2465. | [112253] Apache Hadoop up to 0.23.x/2.7.4/2.8.2 MapReduce Job History Server Configuration File privilege escalation
  2466. | [112171] Oracle Secure Global Desktop 5.3 Apache Log4j privilege escalation
  2467. | [112164] Oracle Agile PLM 9.3.5/9.3.6 Apache Tomcat unknown vulnerability
  2468. | [112161] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat privilege escalation
  2469. | [112158] Oracle Autovue for Agile Product Lifecycle Management 21.0.0/21.0.1 Apache Log4j privilege escalation
  2470. | [112156] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Log4j privilege escalation
  2471. | [112155] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Apache Log4j privilege escalation
  2472. | [112137] Oracle MICROS Relate CRM Software 10.8.x/11.4.x/15.0.x, Apache Tomcat unknown vulnerability
  2473. | [112136] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat privilege escalation
  2474. | [112133] Oracle Retail Workforce Management 1.60.7/1.64.0 Apache Log4j privilege escalation
  2475. | [112129] Oracle Retail Assortment Planning 14.1.3/15.0.3/16.0.1 Apache Log4j privilege escalation
  2476. | [112114] Oracle 9.1 Apache Log4j privilege escalation
  2477. | [112113] Oracle 9.1 Apache Log4j privilege escalation
  2478. | [112045] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat privilege escalation
  2479. | [112038] Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat information disclosure
  2480. | [112019] Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat privilege escalation
  2481. | [112017] Oracle WebCenter Portal 11.1.1.9.0/12.2.1.2.0/12.2.1.3.0 Apache Struts 1 cross site scripting
  2482. | [112011] Oracle Identity Manager 11.1.2.3.0 Apache Commons Collections privilege escalation
  2483. | [111950] Oracle Database 12.2.0.1 Apache Tomcat information disclosure
  2484. | [111703] Apache Sling XSS Protection API 1.0.4 URL Encoding cross site scripting
  2485. | [111556] Apache Geode up to 1.2.x Secure Mode Parameter OQL privilege escalation
  2486. | [111555] Apache Geode up to 1.2.x Secure Mode OQL privilege escalation
  2487. | [111540] Apache Geode up to 1.2.x Secure Mode information disclosure
  2488. | [111519] Apache Sling JCR ContentLoader 2.1.4 xmlreader directory traversal
  2489. | [111338] Apache DeltaSpike-JSF 1.8.0 cross site scripting
  2490. | [111330] Apache OFBiz 16.11.01/16.11.02/16.11.03 BIRT Plugin cross site scripting
  2491. | [110789] Apache Sling up to 1.4.0 Authentication Service Credentials information disclosure
  2492. | [110785] Apache Drill up to 1.11.0 Query Page unknown vulnerability
  2493. | [110701] Apache Fineract Query Parameter sql injection
  2494. | [110484] Apache Synapse up to 3.0.0 Apache Commons Collections Serialized Object Code Injection privilege escalation
  2495. | [110426] Adobe Experience Manager 6.0/6.1/6.2/6.3 Apache Sling Servlets Post cross site scripting
  2496. | [110141] Apache Struts up to 2.5.14 REST Plugin denial of service
  2497. | [110140] Apache Qpid Broker-J up to 0.32 privilege escalation
  2498. | [110139] Apache Qpid Broker-J up to 6.1.4 AMQP Frame denial of service
  2499. | [110106] Apache CXF Fediz Spring cross site request forgery
  2500. | [109766] Apache OpenOffice up to 4.1.3 DOC File Parser WW8Fonts memory corruption
  2501. | [109750] Apache OpenOffice up to 4.1.3 DOC File Parser ImportOldFormatStyles memory corruption
  2502. | [109749] Apache OpenOffice up to 4.1.3 PPT File Parser PPTStyleSheet memory corruption
  2503. | [109606] October CMS Build 412 Apache Configuration File Upload privilege escalation
  2504. | [109419] Apache Camel up to 2.19.3/2.20.0 camel-castor Java Object Deserialization privilege escalation
  2505. | [109418] Apache Camel up to 2.19.3/2.20.0 camel-hessian Java Object Deserialization privilege escalation
  2506. | [109400] Apache CouchDB up to 1.6.x/2.1.0 Database Server Shell privilege escalation
  2507. | [109399] Apache CouchDB up to 1.6.x/2.1.0 JSON Parser Shell privilege escalation
  2508. | [109398] Apache CXF 3.1.14/3.2.1 JAX-WS/JAX-RS Attachment denial of service
  2509. | [108872] Apache Hive up to 2.1.1/2.2.0/2.3.0 Policy Enforcement privilege escalation
  2510. | [108939] Apple macOS up to 10.13.1 apache unknown vulnerability
  2511. | [108938] Apple macOS up to 10.13.1 apache denial of service
  2512. | [108937] Apple macOS up to 10.13.1 apache unknown vulnerability
  2513. | [108936] Apple macOS up to 10.13.1 apache unknown vulnerability
  2514. | [108935] Apple macOS up to 10.13.1 apache denial of service
  2515. | [108934] Apple macOS up to 10.13.1 apache unknown vulnerability
  2516. | [108933] Apple macOS up to 10.13.1 apache unknown vulnerability
  2517. | [108932] Apple macOS up to 10.13.1 apache unknown vulnerability
  2518. | [108931] Apple macOS up to 10.13.1 apache denial of service
  2519. | [108930] Apple macOS up to 10.13.1 apache unknown vulnerability
  2520. | [108929] Apple macOS up to 10.13.1 apache denial of service
  2521. | [108928] Apple macOS up to 10.13.1 apache unknown vulnerability
  2522. | [108797] Apache Struts up to 2.3.19 TextParseUtiltranslateVariables OGNL Expression privilege escalation
  2523. | [108795] Apache Traffic Server up to 5.3.0 HTTP2 set_dynamic_table_size memory corruption
  2524. | [108794] Apache WSS4J up to 1.6.16/2.0.1 Incomplete Fix Leak information disclosure
  2525. | [108793] Apache Qpid up to 0.30 qpidd Crash denial of service
  2526. | [108792] Apache Traffic Server up to 5.1.0 Access Restriction privilege escalation
  2527. | [108791] Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2 Session information disclosure
  2528. | [108790] Apache Storm 0.9.0.1 Log Viewer directory traversal
  2529. | [108789] Apache Cordova In-App-Browser Standalone Plugin up to 0.3.1 on iOS CDVInAppBrowser privilege escalation
  2530. | [108788] Apache Cordova File-Transfer Standalone Plugin up to 0.4.1 on iOS ios/CDVFileTransfer.m spoofing
  2531. | [108787] Apache HttpClient up to 4.3.0 HttpClientBuilder.java unknown vulnerability
  2532. | [108786] Apache Wicket up to 1.4.21/1.5.9/6.3.x script Tag cross site scripting
  2533. | [108783] Apache Hadoop up to 0.23.3/1.0.3/2.0.1 Kerberos Security Feature Key weak encryption
  2534. | [108782] Apache Xerces2 XML Service denial of service
  2535. | [108781] Apache jUDDI up to 1.x happyjuddi.jsp Parameter cross site scripting
  2536. | [108780] Apache jUDDI up to 1.x Log File uddiget.jsp spoofing
  2537. | [108709] Apache Cordova Android up to 3.7.1/4.0.1 intent URL privilege escalation
  2538. | [108708] Apache ActiveMQ up to 5.10.0 XML Data XML External Entity
  2539. | [108707] Apache ActiveMQ up to 1.7.0 XML Data XML External Entity
  2540. | [108629] Apache OFBiz up to 10.04.01 privilege escalation
  2541. | [108543] Apache Derby 10.1.2.1/10.2.2.0/10.3.1.4/10.4.1.3 Export File privilege escalation
  2542. | [108312] Apache HTTP Server on RHEL IP Address Filter privilege escalation
  2543. | [108297] Apache NiFi up to 0.7.1/1.1.1 Proxy Chain Username Deserialization privilege escalation
  2544. | [108296] Apache NiFi up to 0.7.1/1.1.1 Cluster Request privilege escalation
  2545. | [108250] Oracle Secure Global Desktop 5.3 Apache HTTP Server memory corruption
  2546. | [108245] Oracle Transportation Management up to 6.3.7 Apache Tomcat unknown vulnerability
  2547. | [108244] Oracle Transportation Management 6.4.1/6.4.2 Apache Commons FileUpload denial of service
  2548. | [108243] Oracle Agile Engineering Data Management 6.1.3/6.2.0 Apache Commons Collections memory corruption
  2549. | [108222] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Batik denial of service
  2550. | [108219] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unknown vulnerability
  2551. | [108217] Oracle Retail Store Inventory Management 13.2.9/14.0.4/14.1.3/15.0.1/16.0.1 Apache Groovy unknown vulnerability
  2552. | [108216] Oracle Retail Convenience and Fuel POS Software 2.1.132 Apache Groovy unknown vulnerability
  2553. | [108169] Oracle MySQL Enterprise Monitor up to 3.2.8.2223/3.3.4.3247/3.4.2.4181 Apache Tomcat unknown vulnerability
  2554. | [108113] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Batik denial of service
  2555. | [108107] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
  2556. | [108102] Oracle Healthcare Master Person Index 4.x Apache Groovy unknown vulnerability
  2557. | [108085] Oracle Identity Manager 11.1.2.3.0 Apache Struts 1 memory corruption
  2558. | [108083] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
  2559. | [108080] Oracle GlassFish Server 3.1.2 Apache Commons FileUpload denial of service
  2560. | [108066] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Tomcat memory corruption
  2561. | [108062] Oracle BI Publisher 11.1.1.7.0/12.2.1.1.0/12.2.1.2.0 Apache ActiveMQ memory corruption
  2562. | [108060] Oracle Enterprise Manager Ops Center 12.2.2/12.3.2 Apache Groovy unknown vulnerability
  2563. | [108033] Oracle Primavera Unifier 9.13/9.14/10.x/15.x/16.x, Apache Groovy unknown vulnerability
  2564. | [108013] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Groovy unknown vulnerability
  2565. | [108011] Oracle Communications Services Gatekeeper 5.1/6.0 Apache Trinidad unknown vulnerability
  2566. | [107904] Apache Struts up to 2.3.28 Double OGNL Evaluation privilege escalation
  2567. | [107860] Apache Solr up to 7.0 Apache Lucene RunExecutableListener XML External Entity
  2568. | [107834] Apache Ranger up to 0.6.1 Change Password privilege escalation
  2569. | [107639] Apache NiFi 1.4.0 XML External Entity
  2570. | [107606] Apache ZooKeper up to 3.4.9/3.5.2 Command CPU Exhaustion denial of service
  2571. | [107597] Apache Roller up to 5.0.2 XML-RPC Protocol Support XML External Entity
  2572. | [107429] Apache Impala up to 2.9.x Kudu Table privilege escalation
  2573. | [107411] Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File File Upload privilege escalation
  2574. | [107385] Apache Geode up to 1.2.0 Secure Mode privilege escalation
  2575. | [107339] Apache OpenNLP up to 1.5.3/1.6.0/1.7.2/1.8.1 XML Data XML External Entity
  2576. | [107333] Apache Wicket up to 8.0.0-M1 CSRF Prevention HTTP Header privilege escalation
  2577. | [107323] Apache Wicket 1.5.10/6.13.0 Class Request information disclosure
  2578. | [107310] Apache Geode up to 1.2.0 Command Line Utility Query privilege escalation
  2579. | [107276] ArcSight ESM/ArcSight ESM Express up to 6.9.1c Patch 3/6.11.0 Apache Tomcat Version information disclosure
  2580. | [107266] Apache Tika up to 1.12 XML Parser XML External Entity
  2581. | [107262] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
  2582. | [107258] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
  2583. | [107197] Apache Xerces Jelly Parser XML File XML External Entity
  2584. | [107193] ZTE NR8950 Apache Commons Collections RMI Request Deserialization privilege escalation
  2585. | [107084] Apache Struts up to 2.3.19 cross site scripting
  2586. | [106877] Apache Struts up to 2.0.33/2.5.10 Freemarker Tag privilege escalation
  2587. | [106875] Apache Struts up to 2.5.5 URL Validator denial of service
  2588. | [106874] Apache Struts up to 2.3.30 Convention Plugin directory traversal
  2589. | [106847] Apache Tomcat up to 7.0.80 VirtualDirContext Source information disclosure
  2590. | [106846] Apache Tomcat up to 7.0.79 on Windows HTTP PUT Method Parameter File Upload privilege escalation
  2591. | [106777] Apache HTTP Server up to 2.2.34/2.4.27 Limit Directive ap_limit_section HTTP Request information disclosure
  2592. | [106739] puppetlabs-apache up to 1.11.0/2.0.x weak authentication
  2593. | [106720] Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4 CryptoMapper privilege escalation
  2594. | [106586] Apache Brooklyn up to 0.9.x REST Server cross site scripting
  2595. | [106562] Apache Spark up to 2.1.1 Launcher API Deserialization privilege escalation
  2596. | [106559] Apache Brooklyn up to 0.9.x SnakeYAML YAML Data Java privilege escalation
  2597. | [106558] Apache Brooklyn up to 0.9.x REST Server cross site request forgery
  2598. | [106556] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
  2599. | [106555] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
  2600. | [106171] Apache Directory LDAP API up to 1.0.0-M30 Timing unknown vulnerability
  2601. | [106167] Apache Struts up to 2.5.12 REST Plugin XML Data privilege escalation
  2602. | [106166] Apache Struts up to 2.3.33/2.5.12 REST Plugin denial of service
  2603. | [106165] Apache Struts up to 2.3.33/2.5.12 URLValidator Regex CPU Exhaustion denial of service
  2604. | [106115] Apache Hadoop up to 2.6.4/2.7.2 YARN NodeManager Password information disclosure
  2605. | [106012] Apache Solr up to 5.5.3/6.4.0 Replication directory traversal
  2606. | [105980] Apache Engine 16.11.01 Parameter Reflected unknown vulnerability
  2607. | [105962] Apache Atlas 0.6.0/0.7.0 Frame cross site scripting
  2608. | [105961] Apache Atlas 0.6.0/0.7.0 Stack Trace information disclosure
  2609. | [105960] Apache Atlas 0.6.0/0.7.0 Search Reflected cross site scripting
  2610. | [105959] Apache Atlas 0.6.0/0.7.0 edit Tag DOM cross site scripting
  2611. | [105958] Apache Atlas 0.6.0/0.7.0 edit Tag Stored cross site scripting
  2612. | [105957] Apache Atlas 0.6.0/0.7.0 Cookie privilege escalation
  2613. | [105905] Apache Atlas 0.6.0/0.7.0/0.7.1 /js privilege escalation
  2614. | [105878] Apache Struts up to 2.3.24.0 privilege escalation
  2615. | [105682] Apache2Triad 1.5.4 phpsftpd/users.php Parameter cross site scripting
  2616. | [105681] Apache2Triad 1.5.4 phpsftpd/users.php Request cross site request forgery
  2617. | [105680] Apache2Triad 1.5.4 Parameter Session Fixation weak authentication
  2618. | [105643] Apache Pony Mail up to 0.8b weak authentication
  2619. | [105288] Apache Sling up to 2.3.21 Sling.evalString() String cross site scripting
  2620. | [105219] Apache Tomcat up to 8.5.15/9.0.0.M21 HTTP2 Bypass directory traversal
  2621. | [105218] Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21 CORS Filter Cache Poisoning privilege escalation
  2622. | [105215] Apache CXF up to 3.0.12/3.1.9 OAuth2 Hawk/JOSE MAC Validation Timing unknown vulnerability
  2623. | [105206] Apache CXF up to 3.0.11/3.1.8 JAX-RS Module XML External Entity
  2624. | [105205] Apache CXF up to 3.0.11/3.1.8 HTTP Transport Module Parameter cross site scripting
  2625. | [105202] Apache Storm 1.0.0/1.0.1/1.0.2/1.0.3/1.1.0 Worker privilege escalation
  2626. | [104987] Apache Xerces-C++ XML Service CPU Exhaustion denial of service
  2627. | [104986] Apache CXF 2.4.5/2.5.1 WS-SP UsernameToken Policy SOAP Request weak authentication
  2628. | [104985] Apache MyFaces Core up to 2.1.4 EL Expression Parameter Injection information disclosure
  2629. | [104983] Apache Wink up to 1.1.1 XML Document xxe privilege escalation
  2630. | [104981] Apache Commons Email 1.0/1.1/1.2/1.3/1.4 Subject Linebreak SMTP privilege escalation
  2631. | [104591] MEDHOST Document Management System Apache Solr Default Credentials weak authentication
  2632. | [104062] Oracle MySQL Enterprise Monitor up to 3.3.3.1199 Apache Tomcat unknown vulnerability
  2633. | [104061] Oracle MySQL Enterprise Monitor up to 3.2.7.1204/3.3.3.1199 Apache Tomcat unknown vulnerability
  2634. | [104060] Oracle MySQL Enterprise Monitor up to 3.1.5.7958/3.2.5.1141/3.3.2.1162 Apache Struts 2 unknown vulnerability
  2635. | [103995] Oracle 8.3/8.4/15.1/15.2 Apache Trinidad unknown vulnerability
  2636. | [103993] Oracle Policy Automation up to 12.2.3 Apache Commons FileUplaod denial of service
  2637. | [103916] Oracle Banking Platform 2.3/2.4/2.4.1/2.5 Apache Commons FileUpload denial of service
  2638. | [103906] Oracle Communications BRM 11.2.0.0.0 Apache Commons Collections privilege escalation
  2639. | [103904] Oracle Communications BRM 11.2.0.0.0/11.3.0.0.0 Apache Groovy memory corruption
  2640. | [103866] Oracle Transportation Management 6.1/6.2 Apache Webserver unknown vulnerability
  2641. | [103816] Oracle BI Publisher 11.1.1.9.0/12.2.1.1.0/12.2.1.2.0 Apache Commons Fileupload denial of service
  2642. | [103797] Oracle Tuxedo System and Applications Monitor Apache Commons Collections privilege escalation
  2643. | [103792] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Commons Fileupload privilege escalation
  2644. | [103791] Oracle Endeca Server 7.6.0.0/7.6.1.0 Apache Commons Collections privilege escalation
  2645. | [103788] Oracle Enterprise Repository 11.1.1.7.0/12.1.3.0.0 Apache ActiveMQ memory corruption
  2646. | [103787] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Groovy memory corruption
  2647. | [103763] Apache Sling up to 1.0.11 XSS Protection API XSS.getValidXML() Application XML External Entity
  2648. | [103762] Apache Sling up to 1.0.12 XSS Protection API XSSAPI.encodeForJSString() Script Tag cross site scripting
  2649. | [103693] Apache OpenMeetings 1.0.0 HTTP Method privilege escalation
  2650. | [103692] Apache OpenMeetings 1.0.0 Tomcat Error information disclosure
  2651. | [103691] Apache OpenMeetings 3.2.0 Parameter privilege escalation
  2652. | [103690] Apache OpenMeetings 1.0.0 sql injection
  2653. | [103689] Apache OpenMeetings 1.0.0 crossdomain.xml privilege escalation
  2654. | [103688] Apache OpenMeetings 1.0.0 weak encryption
  2655. | [103687] Apache OpenMeetings 1.0.0 cross site request forgery
  2656. | [103556] Apache Roller 5.1.0/5.1.1 Weblog Page Template VTL privilege escalation
  2657. | [103554] Apache OpenMeetings 1.0.0 Password Update unknown vulnerability
  2658. | [103553] Apache OpenMeetings 1.0.0 File Upload privilege escalation
  2659. | [103552] Apache OpenMeetings 3.2.0 Chat cross site scripting
  2660. | [103551] Apache OpenMeetings 3.1.0 XML unknown vulnerability
  2661. | [103521] Apache HTTP Server 2.4.26 HTTP2 Free memory corruption
  2662. | [103520] Apache HTTP Server up to 2.2.33/2.4.26 mod_auth_digest Authorization Header memory corruption
  2663. | [103519] Apache Struts up to 2.5.11/2.3.32 Spring AOP denial of service
  2664. | [103518] Apache Struts up to 2.5.11 URLValidator directory traversal
  2665. | [103492] Apache Spark up to 2.1.x Web UI Reflected cross site scripting
  2666. | [103401] Apache Struts 2.3.x Struts 1 Plugin ActionMessage privilege escalation
  2667. | [103399] Apache Traffic Control Traffic Router TCP Connection Slowloris denial of service
  2668. | [103387] Apache Impala up to 2.8.0 StatestoreSubscriber weak encryption
  2669. | [103386] Apache Impala up to 2.7.x/2.8.0 Kerberos weak authentication
  2670. | [103352] Apache Solr Node weak authentication
  2671. | [102897] Apache Ignite up to 2.0 Update Notifier information disclosure
  2672. | [102878] Code42 CrashPlan 5.4.x RMI Server org.apache.commons.ssl.rmi.DateRMI privilege escalation
  2673. | [102698] Apache HTTP Server up to 2.2.32/2.4.25 mod_mime Content-Type memory corruption
  2674. | [102697] Apache HTTP Server 2.2.24/2.2.32 HTTP Strict Parsing ap_find_token Request Header memory corruption
  2675. | [102690] Apache HTTP Server up to 2.2.32/2.4.25 mod_ssl ap_hook_process_connection() denial of service
  2676. | [102689] Apache HTTP Server up to 2.2.32/2.4.25 ap_get_basic_auth_pw weak authentication
  2677. | [102622] Apache Thrift up to 0.9.2 Client Libraries skip denial of service
  2678. | [102538] Apache Ranger up to 0.7.0 Authorizer unknown vulnerability
  2679. | [102537] Apache Ranger up to 0.7.0 Wildcard Character unknown vulnerability
  2680. | [102536] Apache Ranger up to 0.6 Stored cross site scripting
  2681. | [102535] Apache Ranger up to 0.6.2 Policy Engine unknown vulnerability
  2682. | [102255] Apache NiFi up to 0.7.3/1.2.x Response Header privilege escalation
  2683. | [102254] Apache NiFi up to 0.7.3/1.2.x UI cross site scripting
  2684. | [102070] Apache CXF Fediz up to 1.1.2/1.2.0 Application Plugin denial of service
  2685. | [102020] Apache Tomcat up to 9.0.0.M1 Java Servlet HTTP Method unknown vulnerability
  2686. | [101858] Apache Hive up to 1.2.1/2.0.0 Client weak authentication
  2687. | [101802] Apache KNOX up to 0.11.0 WebHDFS privilege escalation
  2688. | [101928] HPE Aruba ClearPass Apache Tomcat information disclosure
  2689. | [101524] Apache Archiva up to 1.x/2.2.1 REST Endpoint cross site request forgery
  2690. | [101513] Apache jUDDI 3.1./3.1.2/3.1.3/3.1.4 Logout Open Redirect
  2691. | [101430] Apache CXF Fediz up to 1.3.1 OIDC Service cross site request forgery
  2692. | [101429] Apache CXF Fediz up to 1.2.3/1.3.1 Plugins cross site request forgery
  2693. | [100619] Apache Hadoop up to 2.6.x HDFS Servlet unknown vulnerability
  2694. | [100618] Apache Hadoop up to 2.7.0 HDFS Web UI cross site scripting
  2695. | [100621] Adobe ColdFusion 10/11/2016 Apache BlazeDS Library Deserialization privilege escalation
  2696. | [100205] Oracle MySQL Enterprise Monitor up to 3.1.6.8003/3.2.1182/3.3.2.1162 Apache Commons FileUpload denial of service
  2697. | [100191] Oracle Secure Global Desktop 4.71/5.2/5.3 Web Server (Apache HTTP Server) information disclosure
  2698. | [100162] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Commons Collections privilege escalation
  2699. | [100160] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Trinidad unknown vulnerability
  2700. | [99969] Oracle WebCenter Sites 11.1.1.8.0 Apache Tomcat memory corruption
  2701. | [99937] Apache Batik up to 1.8 privilege escalation
  2702. | [99936] Apache FOP up to 2.1 privilege escalation
  2703. | [99935] Apache CXF up to 3.0.12/3.1.10 STSClient Cache information disclosure
  2704. | [99934] Apache CXF up to 3.0.12/3.1.10 JAX-RS XML Security Streaming Client spoofing
  2705. | [99930] Apache Traffic Server up to 6.2.0 denial of service
  2706. | [99929] Apache Log4j up to 2.8.1 Socket Server Deserialization privilege escalation
  2707. | [99925] Apache Traffic Server 6.0.0/6.1.0/6.2.0 HPACK Bomb denial of service
  2708. | [99738] Ping Identity OpenID Connect Authentication Module up to 2.13 on Apache Mod_auth_openidc.c spoofing
  2709. | [117569] Apache Hadoop up to 2.7.3 privilege escalation
  2710. | [99591] Apache TomEE up to 1.7.3/7.0.0-M2 EjbObjectInputStream Serialized Object privilege escalation
  2711. | [99370] Apache Ignite up to 1.8 update-notifier Document XML External Entity
  2712. | [99299] Apache Geode up to 1.1.0 Pulse OQL Query privilege escalation
  2713. | [99572] Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener privilege escalation
  2714. | [99570] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP Connector Cache information disclosure
  2715. | [99569] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP/2 GOAWAY Frame Resource Exhaustion denial of service
  2716. | [99568] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 Pipelined Request information disclosure
  2717. | [99048] Apache Ambari up to 2.3.x REST API Shell Metacharacter privilege escalation
  2718. | [99014] Apache Camel Jackson/JacksonXML privilege escalation
  2719. | [98610] Apple macOS up to 10.12.3 apache_mod_php memory corruption
  2720. | [98609] Apple macOS up to 10.12.3 apache_mod_php denial of service
  2721. | [98608] Apple macOS up to 10.12.3 apache_mod_php memory corruption
  2722. | [98607] Apple macOS up to 10.12.3 apache_mod_php denial of service
  2723. | [98606] Apple macOS up to 10.12.3 apache_mod_php denial of service
  2724. | [98605] Apple macOS up to 10.12.3 Apache denial of service
  2725. | [98604] Apple macOS up to 10.12.3 Apache denial of service
  2726. | [98603] Apple macOS up to 10.12.3 Apache denial of service
  2727. | [98602] Apple macOS up to 10.12.3 Apache denial of service
  2728. | [98601] Apple macOS up to 10.12.3 Apache denial of service
  2729. | [98517] Apache POI up to 3.14 OOXML File XXE denial of service
  2730. | [98405] Apache Hadoop up to 0.23.10 privilege escalation
  2731. | [98199] Apache Camel Validation XML External Entity
  2732. | [97892] Apache Tomcat up to 9.0.0.M15 Reverse-Proxy Http11InputBuffer.java information disclosure
  2733. | [97617] Apache Camel camel-snakeyaml Deserialization privilege escalation
  2734. | [97602] Apache Camel camel-jackson/camel-jacksonxml CamelJacksonUnmarshalType privilege escalation
  2735. | [97732] Apache Struts up to 2.3.31/2.5.10 Jakarta Multipart Parser Content-Type privilege escalation
  2736. | [97466] mod_auth_openidc up to 2.1.5 on Apache weak authentication
  2737. | [97455] mod_auth_openidc up to 2.1.4 on Apache weak authentication
  2738. | [97081] Apache Tomcat HTTPS Request denial of service
  2739. | [97162] EMC OpenText Documentum D2 BeanShell/Apache Commons privilege escalation
  2740. | [96949] Hanwha Techwin Smart Security Manager up to 1.5 Redis/Apache Felix Gogo privilege escalation
  2741. | [96314] Apache Cordova up to 6.1.1 on Android weak authentication
  2742. | [95945] Apple macOS up to 10.12.2 apache_mod_php denial of service
  2743. | [95944] Apple macOS up to 10.12.2 apache_mod_php denial of service
  2744. | [95943] Apple macOS up to 10.12.2 apache_mod_php memory corruption
  2745. | [95666] Oracle FLEXCUBE Direct Banking 12.0.0/12.0.1/12.0.2/12.0.3 Apache Commons Collections privilege escalation
  2746. | [95455] Apache NiFi up to 1.0.0/1.1.0 Connection Details Dialogue cross site scripting
  2747. | [95311] Apache Storm UI Daemon privilege escalation
  2748. | [95291] ZoneMinder 1.30.0 Apache httpd privilege escalation
  2749. | [94800] Apache Wicket up to 1.5.16/6.24.x Deserialize DiskFileItem denial of service
  2750. | [94705] Apache Qpid Broker for Java up to 6.1.0 SCRAM-SHA-1/SCRAM-SHA-256 User information disclosure
  2751. | [94627] Apache HTTP Server up to 2.4.24 mod_auth_digest Crash denial of service
  2752. | [94626] Apache HTTP Server up to 2.4.24 mod_session_crypto Padding weak encryption
  2753. | [94625] Apache HTTP Server up to 2.4.24 Response Split privilege escalation
  2754. | [94540] Apache Tika 1.9 tika-server File information disclosure
  2755. | [94600] Apache ActiveMQ up to 5.14.1 Administration Console cross site scripting
  2756. | [94348] Apple macOS up to 10.12.1 apache_mod_php denial of service
  2757. | [94347] Apple macOS up to 10.12.1 apache_mod_php denial of service
  2758. | [94346] Apple macOS up to 10.12.1 apache_mod_php denial of service
  2759. | [94345] Apple macOS up to 10.12.1 apache_mod_php denial of service
  2760. | [94344] Apple macOS up to 10.12.1 apache_mod_php denial of service
  2761. | [94343] Apple macOS up to 10.12.1 apache_mod_php memory corruption
  2762. | [94342] Apple macOS up to 10.12.1 apache_mod_php memory corruption
  2763. | [94128] Apache Tomcat up to 9.0.0.M13 Error information disclosure
  2764. | [93958] Apache HTTP Server up to 2.4.23 mod_http2 h2_stream.c denial of service
  2765. | [93874] Apache Subversion up to 1.8.16/1.9.4 mod_dontdothat XXE denial of service
  2766. | [93855] Apache Hadoop up to 2.6.4/2.7.2 HDFS Service privilege escalation
  2767. | [93609] Apache OpenMeetings 3.1.0 RMI Registry privilege escalation
  2768. | [93555] Apache Tika 1.6-1.13 jmatio MATLAB File privilege escalation
  2769. | [93799] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
  2770. | [93798] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
  2771. | [93797] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 HTTP Split privilege escalation
  2772. | [93796] Apache Tomcat up to 8.5.6/9.0.0.M11 HTTP/2 Header Parser denial of service
  2773. | [93532] Apache Commons Collections Library Java privilege escalation
  2774. | [93210] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 ResourceLinkFactory privilege escalation
  2775. | [93209] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Realm Authentication User information disclosure
  2776. | [93208] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 System Property Replacement information disclosure
  2777. | [93207] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Utility Method privilege escalation
  2778. | [93206] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Configuration privilege escalation
  2779. | [93098] Apache Commons FileUpload privilege escalation
  2780. | [92987] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Commons Collection memory corruption
  2781. | [92986] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Tomcat memory corruption
  2782. | [92982] Oracle Insurance IStream 4.3.2 Apache Commons Collections memory corruption
  2783. | [92981] Oracle Financial Services Lending and Leasing 14.1.0/14.2.0 Apache Commons Collections memory corruption
  2784. | [92979] Oracle up to 8.0.3 Apache Commons Collections memory corruption
  2785. | [92977] Oracle FLEXCUBE Universal Banking up to 12.2.0 Apache Commons Collections memory corruption
  2786. | [92976] Oracle FLEXCUBE Universal Banking 12.87.1/12.87.2 Apache Commons Collections memory corruption
  2787. | [92975] Oracle FLEXCUBE Private Banking up to 12.1.0 Apache Commons Collections memory corruption
  2788. | [92974] Oracle FLEXCUBE Investor Servicing 12.0.1 Apache Commons Collections memory corruption
  2789. | [92973] Oracle 12.0.0/12.1.0 Apache Commons Collections memory corruption
  2790. | [92972] Oracle FLEXCUBE Core Banking 11.5.0.0.0/11.6.0.0.0 Apache Commons Collections memory corruption
  2791. | [92962] Oracle Agile PLM 9.3.4/9.3.5 Apache Commons Collections memory corruption
  2792. | [92909] Oracle Agile PLM 9.3.4/9.3.5 Apache Tomcat unknown vulnerability
  2793. | [92786] Oracle Banking Digital Experience 15.1 Apache Commons Collections information disclosure
  2794. | [92549] Apache Tomcat on Red Hat privilege escalation
  2795. | [92509] Apache Tomcat JK ISAPI Connector up to 1.2.41 jk_uri_worker_map.c memory corruption
  2796. | [92314] Apache MyFaces Trinidad up to 1.0.13/1.2.15/2.0.1/2.1.1 CoreResponseStateManager memory corruption
  2797. | [92313] Apache Struts2 up to 2.3.28/2.5.0 Action Name Cleanup cross site request forgery
  2798. | [92299] Apache Derby up to 10.12.1.0 SqlXmlUtil XML External Entity
  2799. | [92217] Apache ActiveMQ Artemis up to 1.3.x Broker/REST GetObject privilege escalation
  2800. | [92174] Apache Ranger up to 0.6.0 Policy cross site scripting
  2801. | [91831] Apache Jackrabbit up to 2.13.2 HTTP Header cross site request forgery
  2802. | [91825] Apache Zookeeper up to 3.4.8/3.5.2 C CLI Shell memory corruption
  2803. | [91818] Apache CXF Fediz up to 1.2.2/1.3.0 Application Plugin privilege escalation
  2804. | [92056] Apple macOS up to 10.11 apache_mod_php memory corruption
  2805. | [92055] Apple macOS up to 10.11 apache_mod_php memory corruption
  2806. | [92054] Apple macOS up to 10.11 apache_mod_php denial of service
  2807. | [92053] Apple macOS up to 10.11 apache_mod_php denial of service
  2808. | [92052] Apple macOS up to 10.11 apache_mod_php denial of service
  2809. | [92051] Apple macOS up to 10.11 apache_mod_php memory corruption
  2810. | [92050] Apple macOS up to 10.11 apache_mod_php denial of service
  2811. | [92049] Apple macOS up to 10.11 apache_mod_php memory corruption
  2812. | [92048] Apple macOS up to 10.11 apache_mod_php denial of service
  2813. | [92047] Apple macOS up to 10.11 apache_mod_php memory corruption
  2814. | [92046] Apple macOS up to 10.11 apache_mod_php memory corruption
  2815. | [92045] Apple macOS up to 10.11 apache_mod_php memory corruption
  2816. | [92044] Apple macOS up to 10.11 apache_mod_php memory corruption
  2817. | [92043] Apple macOS up to 10.11 apache_mod_php denial of service
  2818. | [92042] Apple macOS up to 10.11 apache_mod_php memory corruption
  2819. | [92041] Apple macOS up to 10.11 apache_mod_php memory corruption
  2820. | [92040] Apple macOS up to 10.11 Apache Proxy privilege escalation
  2821. | [91785] Apache Shiro up to 1.3.1 Servlet Filter privilege escalation
  2822. | [90879] Apache OpenMeetings up to 3.1.1 SWF Panel cross site scripting
  2823. | [90878] Apache Sentry up to 1.6.x Blacklist Filter reflect/reflect2/java_method privilege escalation
  2824. | [90610] Apache POI up to 3.13 XLSX2CSV Example OpenXML Document XML External Entity
  2825. | [90584] Apache ActiveMQ up to 5.11.3/5.12.2/5.13/1 Administration Web Console privilege escalation
  2826. | [90385] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site scripting
  2827. | [90384] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site request forgery
  2828. | [90383] Apache OpenOffice up to 4.1.2 Impress File memory corruption
  2829. | [89670] Apache Tomcat up to 8.5.4 CGI Servlet Environment Variable Open Redirect
  2830. | [89669] Apache HTTP Server up to 2.4.23 RFC 3875 Namespace Conflict Environment Variable Open Redirect
  2831. | [89726] Apple Mac OS X up to 10.11.5 apache_mod_php memory corruption
  2832. | [89484] Apache Qpid up to 0.13.0 on Windows Proton Library Certificate weak authentication
  2833. | [89473] HPE iMC PLAT/EAD/APM/iMC NTA/iMC BIMS/iMC UAM_TAM up to 7.2 Apache Commons Collections Library Command privilege escalation
  2834. | [90263] Apache Archiva Header denial of service
  2835. | [90262] Apache Archiva Deserialize privilege escalation
  2836. | [90261] Apache Archiva XML DTD Connection privilege escalation
  2837. | [88827] Apache Xerces-C++ up to 3.1.3 DTD Stack-Based memory corruption
  2838. | [88747] Apache HTTP Server 2.4.17/2.4.18 mod_http2 denial of service
  2839. | [88608] Apache Struts up to 2.3.28.1/2.5.0 URLValidator Null Value denial of service
  2840. | [88607] Apache Struts up to 2.3.28.1 REST Plugin Expression privilege escalation
  2841. | [88606] Apache Struts up to 2.3.28.1 Restriction privilege escalation
  2842. | [88605] Apache Struts up to 2.3.28.1 Restriction privilege escalation
  2843. | [88604] Apache Struts up to 2.3.28.1 Token Validator cross site request forgery
  2844. | [88603] Apache Commons FileUpload up to 1.3.1 MultipartStream denial of service
  2845. | [88602] Apache Struts up to 1.3.10 ActionServlet.java cross site scripting
  2846. | [88601] Apache Struts up to 1.3.10 Multithreading ActionServlet.java memory corruption
  2847. | [88600] Apache Struts up to 1.3.10 MultiPageValidator privilege escalation
  2848. | [89005] Apache Qpid AMQP JMS Client getObject privilege escalation
  2849. | [87888] Apache Ranger up to 0.5.2 Policy Admin Tool eventTime sql injection
  2850. | [87835] Apache CloudStack up to 4.5.2.0/4.6.2.0/4.7.1.0/4.8.0.0 SAML-based Authentication privilege escalation
  2851. | [87806] HPE Discovery and Dependency Mapping Inventory up to 9.32 update 3 Apache Commons Collections Library privilege escalation
  2852. | [87805] HPE Universal CMDB up to 10.21 Apache Commons Collections Library privilege escalation
  2853. | [87768] Apache Shiro up to 1.2.4 Cipher Key privilege escalation
  2854. | [87765] Apache James Server 2.3.2 Command privilege escalation
  2855. | [88667] Apache HTTP Server up to 2.4.20 mod_http2 Certificate weak authentication
  2856. | [87718] Apache Struts up to 2.3.24.1 OGNL Caching denial of service
  2857. | [87717] Apache Struts up to 2.3.28 REST Plugin privilege escalation
  2858. | [87706] Apache Qpid Java up to 6.0.2 AMQP privilege escalation
  2859. | [87703] Apache Qbid Java up to 6.0.2 PlainSaslServer.java denial of service
  2860. | [87702] Apache ActiveMQ up to 5.13.x Fileserver Web Application Upload privilege escalation
  2861. | [87700] Apache PDFbox up to 1.8.11/2.0.0 XML Parser PDF Document XML External Entity
  2862. | [87679] HP Release Control 9.13/9.20/9.21 Apache Commons Collections Library Java Object privilege escalation
  2863. | [87540] Apache Ambari up to 2.2.0 File Browser View information disclosure
  2864. | [87433] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
  2865. | [87432] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
  2866. | [87431] Apple Mac OS X up to 10.11.4 apache_mod_php Format String
  2867. | [87430] Apple Mac OS X up to 10.11.4 apache_mod_php denial of service
  2868. | [87429] Apple Mac OS X up to 10.11.4 apache_mod_php information disclosure
  2869. | [87428] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
  2870. | [87427] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
  2871. | [87389] Apache Xerces C++ up to 3.1.3 XML Document DTDScanner.cpp memory corruption
  2872. | [87172] Adobe ColdFusion 11 Update 7/2016/up to 10 Update 18 Apache Commons Collections Library privilege escalation
  2873. | [87121] Apache Cordova iOS up to 3.x Plugin privilege escalation
  2874. | [87120] Apache Cordova iOS up to 3.x URL Whitelist privilege escalation
  2875. | [83806] HPE Network Node Manager i up to 10.01 Apache Commons Collections Library privilege escalation
  2876. | [83077] Apache Subversion up to 1.8.15/1.9.3 mod_authz_svn mod_authz_svn.c denial of service
  2877. | [83076] Apache Subversion up to 1.8.15/1.9.3 svnserve svnserve/cyrus_auth.c privilege escalation
  2878. | [82790] Apache Struts 2.0.0/2.3.24/2.3.28 Dynamic Method privilege escalation
  2879. | [82789] Apache Struts 2.0.0/2.3.24/2.3.28 XSLTResult privilege escalation
  2880. | [82725] HPE P9000 Command View up to 7.x/8.4.0 Apache Commons Collections Library privilege escalation
  2881. | [82444] Apache Camel up to 2.14.x/2.15.4/2.16.0 HTTP Request privilege escalation
  2882. | [82389] Apache Subversion up to 1.7.x/1.8.14/1.9.2 mod_dav_svn util.c memory corruption
  2883. | [82280] Apache Struts up to 1.7 JRE URLDecoder cross site scripting
  2884. | [82260] Apache OFBiz up to 12.04.05/13.07.02 Java Object privilege escalation
  2885. | [82259] Apache Qpid Proton up to 0.12.0 proton.reactor.Connector weak encryption
  2886. | [82250] Apache Ranger up to 0.5.0 Admin UI weak authentication
  2887. | [82214] Apache Wicket up to 1.5.14/6.21.x/7.1.x Input Element cross site scripting
  2888. | [82213] Apache Wicket up to 1.5.14/6.21.x/7.1.x ModalWindow Title getWindowOpenJavaScript cross site scripting
  2889. | [82212] Apache Ranger up to 0.5.0 Policy Admin Tool privilege escalation
  2890. | [82211] Apache OFBiz up to 12.04.06/13.07.02 ModelFormField.java DisplayEntityField.getDescription cross site scripting
  2891. | [82082] Apache JetSpeed up to 2.3.0 User Manager Service privilege escalation
  2892. | [82081] Apache OpenMeetings up to 3.1.0 SOAP API information disclosure
  2893. | [82080] Apache OpenMeetings up to 3.1.0 Event cross site scripting
  2894. | [82078] Apache OpenMeetings up to 3.1.0 Import/Export System Backup ZIP Archive directory traversal
  2895. | [82077] Apache OpenMeetings up to 3.1.0 Password Reset sendHashByUser privilege escalation
  2896. | [82076] Apache Ranger up to 0.5.1 privilege escalation
  2897. | [82075] Apache JetSpeed up to 2.3.0 Portal cross site scripting
  2898. | [82074] Apache JetSpeed up to 2.3.0 cross site scripting
  2899. | [82073] Apache JetSpeed up to 2.3.0 User Manager Service sql injection
  2900. | [82072] Apache JetSpeed up to 2.3.0 Portal Site Manager ZIP Archive directory traversal
  2901. | [82058] Apache LDAP Studio/Directory Studio up to 2.0.0-M9 CSV Export privilege escalation
  2902. | [82053] Apache Ranger up to 0.4.x Policy Admin Tool privilege escalation
  2903. | [82052] Apache Ranger up to 0.4.x Policy Admin Tool HTTP Request cross site scripting
  2904. | [81696] Apache ActiveMQ up to 5.13.1 HTTP Header privilege escalation
  2905. | [81695] Apache Xerces-C up to 3.1.2 internal/XMLReader.cpp memory corruption
  2906. | [81622] HPE Asset Manager 9.40/9.41/9.50 Apache Commons Collections Library Java Object privilege escalation
  2907. | [81406] HPE Service Manager up to 9.35 P3/9.41 P1 Apache Commons Collections Library Command privilege escalation
  2908. | [81405] HPE Operations Orchestration up to 10.50 Apache Commons Collections Library Command privilege escalation
  2909. | [81427] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
  2910. | [81426] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
  2911. | [81372] Apache Struts up to 2.3.24.1 I18NInterceptor cross site scripting
  2912. | [81371] Apache Struts up to 2.3.24.1 Double OGNL Evaluation privilege escalation
  2913. | [81370] Apache Struts up to 2.3.24.1 Java URLDecoder cross site scripting
  2914. | [81084] Apache Tomcat 6.0/7.0/8.0/9.0 ServletContext directory traversal
  2915. | [81083] Apache Tomcat 7.0/8.0/9.0 Index Page cross site request forgery
  2916. | [81082] Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext privilege escalation
  2917. | [81081] Apache Tomcat 6.0/7.0/8.0/9.0 Error information disclosure
  2918. | [81080] Apache Tomcat 6.0/7.0/8.0/9.0 Session Persistence privilege escalation
  2919. | [81079] Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure
  2920. | [81078] Apache Tomcat 7.0/8.0/9.0 Session privilege escalation
  2921. | [80970] Apache Solr up to 5.3.0 Admin UI plugins.js cross site scripting
  2922. | [80969] Apache Solr up to 5.2 Schema schema-browser.js cross site scripting
  2923. | [80968] Apache Solr up to 5.0 analysis.js cross site scripting
  2924. | [80940] HP Continuous Delivery Automation 1.30 Apache Commons Collections Library privilege escalation
  2925. | [80823] Apache CloudStack up to 4.5.1 KVM Virtual Machine Migration privilege escalation
  2926. | [80822] Apache CloudStack up to 4.5.1 API Call information disclosure
  2927. | [80778] Apache Camel up to 2.15.4/2.16.0 camel-xstream privilege escalation
  2928. | [80750] HPE Operations Manager 8.x/9.0 on Windows Apache Commons Collections Library privilege escalation
  2929. | [80724] Apache Hive up to 1.2.1 Authorization Framework privilege escalation
  2930. | [80577] Oracle Secure Global Desktop 4.63/4.71/5.2 Apache HTTP Server denial of service
  2931. | [80165] Intel McAfee ePolicy Orchestrator up to 4.6.9/5.0.3/5.3.1 Apache Commons Collections Library privilege escalation
  2932. | [80116] Apache Subversion up to 1.9.2 svn Protocol libsvn_ra_svn/marshal.c read_string memory corruption
  2933. | [80115] Apache ActiveMQ up to 5.12.x Broker Service privilege escalation
  2934. | [80036] IBM Cognos Business Intelligence Apache Commons Collections Library InvokerTransformer privilege escalation
  2935. | [79873] VMware vCenter Operations/vRealize Orchestrator Apache Commons Collections Library Serialized Java Object privilege escalation
  2936. | [79840] Apache Cordova File Transfer Plugin up to 1.2.x on Android unknown vulnerability
  2937. | [79839] Apache TomEE Serialized Java Stream EjbObjectInputStream privilege escalation
  2938. | [79791] Cisco Products Apache Commons Collections Library privilege escalation
  2939. | [79539] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
  2940. | [79538] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
  2941. | [79294] Apache Cordova-Android up to 3.6 BridgeSecret Random Generator weak encryption
  2942. | [79291] Apache Cordova-Android up to 4.0 Javascript Whitelist privilege escalation
  2943. | [79244] Apache CXF up to 2.7.17/3.0.7/3.1.2 SAML Web SSO Module SAML Response weak authentication
  2944. | [79243] Oracle WebLogic Server 10.3.6.0/12.1.2.0/12.1.3.0/12.2.1.0 WLS Security com.bea.core.apache.commons.collections.jar privilege escalation
  2945. | [78989] Apache Ambari up to 2.1.1 Open Redirect
  2946. | [78988] Apache Ambari up to 2.0.1/2.1.0 Password privilege escalation
  2947. | [78987] Apache Ambari up to 2.0.x cross site scripting
  2948. | [78986] Apache Ambari up to 2.0.x Proxy Endpoint api/v1/proxy privilege escalation
  2949. | [78780] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
  2950. | [78779] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
  2951. | [78778] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
  2952. | [78777] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
  2953. | [78776] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
  2954. | [78775] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
  2955. | [78774] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
  2956. | [78297] Apache Commons Components HttpClient up to 4.3.5 HTTPS Timeout denial of service
  2957. | [77406] Apache Flex BlazeDS AMF Message XML External Entity
  2958. | [77429] Apache ActiveMQ up to 5.10.0 LDAPLoginModule privilege escalation
  2959. | [77399] Apache ActiveMQ up to 5.10.0 LDAPLoginModule weak authentication
  2960. | [77375] Apache Tapestry up to 5.3.5 Client-Side Object Storage privilege escalation
  2961. | [77331] Apache ActiveMQ up to 5.11.1 on Windows Fileserver Upload/Download directory traversal
  2962. | [77299] Apache Solr Real-Time Module up to 7.x-1.1 Index Content information disclosure
  2963. | [77247] Apache ActiveMQ up to 5.10 TransportConnection.java processControlCommand denial of service
  2964. | [77083] Apache Groovy up to 2.4.3 MethodClosure.java MethodClosure memory corruption
  2965. | [76953] Apache Subversion 1.7.0/1.8.0/1.8.10 svn_repos_trace_node_locations information disclosure
  2966. | [76952] Apache Subversion 1.7.0/1.8.0/1.8.10 mod_authz_svn anonymous/authenticated information disclosure
  2967. | [76567] Apache Struts 2.3.20 unknown vulnerability
  2968. | [76733] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 ap_some_auth_required unknown vulnerability
  2969. | [76732] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 Request apr_brigade_flatten privilege escalation
  2970. | [76731] Apache HTTP Server 2.4.12 ErrorDocument 400 Crash denial of service
  2971. | [75690] Apache Camel up to 2.13.3/2.14.1 XPathBuilder.java XML External Entity
  2972. | [75689] Apache Camel up to 2.13.3/2.14.1 XML Converter Setup XmlConverter.java SAXSource privilege escalation
  2973. | [75668] Apache Sling API/Sling Servlets Post up to 2.2.1 HtmlResponse cross site scripting
  2974. | [75601] Apache Jackrabbit up to 2.10.0 WebDAV Request XML External Entity
  2975. | [75420] Apache Tomcat up to 6.0.43/7.0.58/8.0.16 Security Manager privilege escalation
  2976. | [75145] Apache OpenOffice up to 4.1.1 HWP Filter Crash denial of service
  2977. | [75032] Apache Tomcat Connectors up to 1.2.40 mod_jk privilege escalation
  2978. | [75135] PHP 5.4/5.5 HTTP Request sapi_apache2.c apache2handler privilege escalation
  2979. | [74793] Apache Tomcat File Upload denial of service
  2980. | [74708] Apple MacOS X up to 10.10.2 Apache denial of service
  2981. | [74707] Apple MacOS X up to 10.10.2 Apache denial of service
  2982. | [74706] Apple MacOS X up to 10.10.2 Apache memory corruption
  2983. | [74705] Apple MacOS X up to 10.10.2 Apache denial of service
  2984. | [74704] Apple MacOS X up to 10.10.2 Apache denial of service
  2985. | [74703] Apple MacOS X up to 10.10.2 Apache denial of service
  2986. | [74702] Apple MacOS X up to 10.10.2 Apache denial of service
  2987. | [74701] Apple MacOS X up to 10.10.2 Apache cross site request forgery
  2988. | [74700] Apple MacOS X up to 10.10.2 Apache unknown vulnerability
  2989. | [74661] Apache Flex up to 4.14.0 asdoc index.html cross site scripting
  2990. | [74609] Apache Cassandra up to 1.2.19/2.0.13/2.1.3 JMX/RMI Interface privilege escalation
  2991. | [74469] Apache Xerces-C up to 7.0 internal/XMLReader.cpp denial of service
  2992. | [74468] Apache Batik up to 1.6 denial of service
  2993. | [74414] Apache Mod-gnutls up to 0.5.1 Authentication spoofing
  2994. | [74371] Apache Standard Taglibs up to 1.2.0 memory corruption
  2995. | [74367] Apache HTTP Server up to 2.4.12 mod_lua lua_request.c wsupgrade denial of service
  2996. | [74174] Apache WSS4J up to 2.0.0 privilege escalation
  2997. | [74172] Apache ActiveMQ up to 5.5.0 Administration Console cross site scripting
  2998. | [69092] Apache Tomcat up to 6.0.42/7.0.54/8.0.8 HTTP Request Smuggling privilege escalation
  2999. | [73831] Apache Qpid up to 0.30 Access Restriction unknown vulnerability
  3000. | [73731] Apache XML Security unknown vulnerability
  3001. | [68660] Oracle BI Publisher 10.1.3.4.2/11.1.1.7 Apache Tomcat cross site scripting
  3002. | [73659] Apache CloudStack up to 4.3.0 Stack-Based unknown vulnerability
  3003. | [73593] Apache Traffic Server up to 5.1.0 denial of service
  3004. | [73511] Apache POI up to 3.10 Deadlock denial of service
  3005. | [73510] Apache Solr up to 4.3.0 cross site scripting
  3006. | [68447] Apache Subversion up to 1.7.18/1.8.10 mod_dav_svn Crash denial of service
  3007. | [68446] Apache Subversion up to 1.7.18/1.8.10 REPORT Request Crash denial of service
  3008. | [73173] Apache CloudStack Stack-Based unknown vulnerability
  3009. | [68357] Apache Struts up to 2.3.16.3 Random Number Generator cross site request forgery
  3010. | [73106] Apache Hadoop up to 2.4.0 Symlink privilege escalation
  3011. | [68575] Apache HTTP Server up to 2.4.10 LuaAuthzProvider mod_lua.c privilege escalation
  3012. | [72890] Apache Qpid 0.30 unknown vulnerability
  3013. | [72887] Apache Hive 0.13.0 File Permission privilege escalation
  3014. | [72878] Apache Cordova 3.5.0 cross site request forgery
  3015. | [72877] Apache Cordova 3.5.0 cross site request forgery
  3016. | [72876] Apache Cordova 3.5.0 cross site request forgery
  3017. | [68435] Apache HTTP Server 2.4.10 mod_proxy_fcgi.c handle_headers denial of service
  3018. | [68065] Apache CXF up to 3.0.1 JAX-RS SAML denial of service
  3019. | [68064] Apache CXF up to 3.0.0 SAML Token denial of service
  3020. | [67913] Oracle Retail Markdown Optimization 12.0/13.0/13.1/13.2/13.4 Apache commons-beanutils-1.8.0.jar memory corruption
  3021. | [67912] Oracle Retail Invoice Matching up to 14.0 Apache commons-beanutils-1.8.0.jar memory corruption
  3022. | [67911] Oracle Retail Clearance Optimization Engine 13.3/13.4/14.0 Apache commons-beanutils-1.8.0.jar memory corruption
  3023. | [67910] Oracle Retail Allocation up to 13.2 Apache commons-beanutils-1.8.0.jar memory corruption
  3024. | [71835] Apache Shiro 1.0.0/1.1.0/1.2.0/1.2.1/1.2.2 unknown vulnerability
  3025. | [71633] Apachefriends XAMPP 1.8.1 cross site scripting
  3026. | [71629] Apache Axis2/C spoofing
  3027. | [67633] Apple Mac OS X up to 10.9.4 apache_mod_php ext/standard/dns.c dns_get_record memory corruption
  3028. | [67631] Apple Mac OS X up to 10.9.4 apache_mod_php Symlink memory corruption
  3029. | [67630] Apple Mac OS X up to 10.9.4 apache_mod_php cdf_read_property_info denial of service
  3030. | [67629] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_count_chain denial of service
  3031. | [67628] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_check_stream_offset denial of service
  3032. | [67627] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c mconvert memory corruption
  3033. | [67626] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c denial of service
  3034. | [67625] Apple Mac OS X up to 10.9.4 apache_mod_php Crash denial of service
  3035. | [67624] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_property_info denial of service
  3036. | [67623] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_unpack_summary_info denial of service
  3037. | [67622] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_short_sector denial of service
  3038. | [67620] Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands denial of service
  3039. | [67790] Apache HTTP Server mod_cache NULL Pointer Dereference denial of service
  3040. | [67522] Apache Tomcat up to 7.0.39 JSP Upload privilege escalation
  3041. | [70809] Apache POI up to 3.11 Crash denial of service
  3042. | [70808] Apache POI up to 3.10 unknown vulnerability
  3043. | [70806] Apache Commons-httpclient 4.2/4.2.1/4.2.2 spoofing
  3044. | [70749] Apache Axis up to 1.4 getCN spoofing
  3045. | [70701] Apache Traffic Server up to 3.3.5 denial of service
  3046. | [70700] Apache OFBiz up to 12.04.03 cross site scripting
  3047. | [67402] Apache OpenOffice 4.0.0/4.0.1/4.1.0 Calc privilege escalation
  3048. | [67401] Apache OpenOffice up to 4.1.0 OLE Object information disclosure
  3049. | [70661] Apache Subversion up to 1.6.17 denial of service
  3050. | [70660] Apache Subversion up to 1.6.17 spoofing
  3051. | [70659] Apache Subversion up to 1.6.17 spoofing
  3052. | [67183] Apache HTTP Server up to 2.4.9 mod_proxy denial of service
  3053. | [67180] Apache HTTP Server up to 2.4.9 WinNT MPM Memory Leak denial of service
  3054. | [67185] Apache HTTP Server up to 2.4.9 mod_status Heap-Based memory corruption
  3055. | [67184] Apache HTTP Server 2.4.5/2.4.6 mod_cache NULL Pointer Dereference denial of service
  3056. | [67182] Apache HTTP Server up to 2.4.9 mod_deflate Memory Consumption denial of service
  3057. | [67181] Apache HTTP Server up to 2.4.9 mod_cgid denial of service
  3058. | [70338] Apache Syncope up to 1.1.7 unknown vulnerability
  3059. | [70295] Apache CXF up to 2.7.9 Cleartext information disclosure
  3060. | [70106] Apache Open For Business Project up to 10.04.0 getServerError cross site scripting
  3061. | [70105] Apache MyFaces up to 2.1.5 JavaServer Faces directory traversal
  3062. | [69846] Apache HBase up to 0.94.8 information disclosure
  3063. | [69783] Apache CouchDB up to 1.2.0 memory corruption
  3064. | [13383] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 XML Parser privilege escalation
  3065. | [13300] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi setuid privilege escalation
  3066. | [13299] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi Content-Type Header information disclosure
  3067. | [13164] Apache CXF up to 2.6.13/2.7.10 SOAP OutgoingChainInterceptor.java Invalid Content denial of service
  3068. | [13163] Apache CXF up to 2.6.13/2.7.10 SOAP HTML Content denial of service
  3069. | [13158] Apache Struts up to 2.3.16.2 ParametersInterceptor getClass privilege escalation
  3070. | [69515] Apache Struts up to 2.3.15.0 CookieInterceptor memory corruption
  3071. | [13086] Apache Struts up to 1.3.10 Class Loader privilege escalation
  3072. | [13067] Apache Struts up to 2.3.16.1 Class Loader privilege escalation
  3073. | [69431] Apache Archiva up to 1.3.6 cross site scripting
  3074. | [69385] Apache Syncope up to 1.1.6 unknown vulnerability
  3075. | [69338] Apache Xalan-Java up to 2.7.1 system-property unknown vulnerability
  3076. | [12742] Trustwave ModSecurity up to 2.7.5 Chunk Extension apache2/modsecurity.c modsecurity_tx_init privilege escalation
  3077. | [12741] Trustwave ModSecurity up to 2.7.6 Chunked HTTP Transfer apache2/modsecurity.c modsecurity_tx_init Trailing Header privilege escalation
  3078. | [13387] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Content-Length Header privilege escalation
  3079. | [13386] Apache Tomcat Security Manager up to 6.0.39/7.0.53/8.0.5 XSLT privilege escalation
  3080. | [13385] Apache Tomcat 8.0.0/8.0.1/8.0.3 AJP Request Zero Length denial of service
  3081. | [13384] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Chunked HTTP Request denial of service
  3082. | [12748] Apache CouchDB 1.5.0 UUIDS /_uuids denial of service
  3083. | [66739] Apache Camel up to 2.12.2 unknown vulnerability
  3084. | [66738] Apache Camel up to 2.12.2 unknown vulnerability
  3085. | [12667] Apache HTTP Server 2.4.7 mod_log_config.c log_cookie denial of service
  3086. | [66695] Apache CouchDB up to 1.2.0 cross site scripting
  3087. | [66694] Apache CouchDB up to 1.2.0 Partition partition2 directory traversal
  3088. | [66689] Apache HTTP Server up to 2.0.33 mod_dav dav_xml_get_cdata denial of service
  3089. | [12518] Apache Tomcat up to 6.0.38/7.0.49/8.0.0-RC9 HTTP Header denial of service
  3090. | [66498] Apache expressions up to 3.3.0 Whitelist unknown vulnerability
  3091. | [12781] Apache Struts up to 2.3.8 ParametersInterceptor getClass denial of service
  3092. | [12439] Apache Tomcat 6.0.33 XML XXE information disclosure
  3093. | [12438] Apache Tomcat 6.0.33/6.0.34/6.0.35/6.0.36/6.0.37 coyoteadapter.java disableURLRewriting privilege escalation
  3094. | [66356] Apache Wicket up to 6.8.0 information disclosure
  3095. | [12209] Apache Tomcat 7.0.0/7.0.50/8.0.0-RC1/8.0.1 Content-Type Header for Multi-Part Request Infinite Loop denial of service
  3096. | [66322] Apache ActiveMQ up to 5.8.0 cross site scripting
  3097. | [12291] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
  3098. | [66255] Apache Open For Business Project up to 10.04.3 cross site scripting
  3099. | [66200] Apache Hadoop up to 2.0.5 Security Feature information disclosure
  3100. | [66072] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
  3101. | [66068] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
  3102. | [11928] Oracle Secure Global Desktop up to 4.71 Apache Tomcat unknown vulnerability
  3103. | [11924] Oracle Secure Global Desktop up to 4.63 Apache Tomcat denial of service
  3104. | [11922] Oracle Secure Global Desktop up to 4.63 Apache Tomcat unknown vulnerability
  3105. | [66049] Apache XML Security for Java up to 1.4.6 Memory Consumption denial of service
  3106. | [12199] Apache Subversion up to 1.8.5 mod_dav_svn/repos.c get_resource denial of service
  3107. | [65946] askapache Firefox Adsense up to 3.0 askapache-firefox-adsense.php cross site request forgery
  3108. | [65668] Apache Solr 4.0.0 Updater denial of service
  3109. | [65665] Apache Solr up to 4.3.0 denial of service
  3110. | [65664] Apache Solr 3.6.0/3.6.1/3.6.2/4.0.0 Updater denial of service
  3111. | [65663] Apache Solr up to 4.5.1 ResourceLoader directory traversal
  3112. | [65658] Apache roller 4.0/4.0.1/5.0/5.0.1 unknown vulnerability
  3113. | [65657] Apache Roller 4.0/4.0.1/5.0/5.0.1 cross site scripting
  3114. | [11325] Apache Subversion 1.7.13 mod_dontdothat Bypass denial of service
  3115. | [11324] Apache Subversion up to 1.8.4 mod_dav_svn denial of service
  3116. | [11098] Apache Tomcat 5.5.25 HTTP Request cross site request forgery
  3117. | [65410] Apache Struts 2.3.15.3 cross site scripting
  3118. | [65386] Apache Solr up to 2.2.1 on TYPO3 cross site scripting
  3119. | [65385] Apache Solr up to 2.2.1 on TYPO3 unknown vulnerability
  3120. | [11044] Apache Struts 2.3.15.3 showConfig.action cross site scripting
  3121. | [11043] Apache Struts 2.3.15.3 actionNames.action cross site scripting
  3122. | [11018] cPanel WHM up to 11.40.0.11 Apache mod_userdir Tweak Interface privilege escalation
  3123. | [65342] Apache Sling 1.0.2/1.0.4/1.0.6/1.1.0/1.1.2 Auth Core cross site scripting
  3124. | [65340] Apache Shindig 2.5.0 information disclosure
  3125. | [65316] Apache Mod Fcgid up to 2.3.7 mod_fcgid fcgid_bucket.c fcgid_header_bucket_read memory corruption
  3126. | [65313] Apache Sling 2.2.0/2.3.0 AbstractCreateOperation.java deepGetOrCreateNode denial of service
  3127. | [10826] Apache Struts 2 File privilege escalation
  3128. | [65204] Apache Camel up to 2.10.1 unknown vulnerability
  3129. | [10460] Apache Struts 2.0.0/2.3.15.1 Action Mapping Mechanism Bypass privilege escalation
  3130. | [10459] Apache Struts 2.0.0/2.3.15 Dynamic Method Invocation unknown vulnerability
  3131. | [10160] Apache Subversion 1.8.0/1.8.1/1.8.2 svnwcsub.py handle_options race condition
  3132. | [10159] Apache Subversion up to 1.8.2 svnserve write_pid_file race condition
  3133. | [10158] Apache Subversion 1.8.0/1.8.1/1.8.2 daemonize.py daemon::daemonize race condition
  3134. | [10157] Apache Subversion up to 1.8.1 FSFS Repository Symlink privilege escalation
  3135. | [64808] Fail2ban up to 0.8.9 apache-auth.conf denial of service
  3136. | [64760] Best Practical RT up to 4.0.12 Apache::Session::File information disclosure
  3137. | [64722] Apache XML Security for C++ Heap-based memory corruption
  3138. | [64719] Apache XML Security for C++ Heap-based memory corruption
  3139. | [64718] Apache XML Security for C++ verify denial of service
  3140. | [64717] Apache XML Security for C++ getURIBaseTXFM memory corruption
  3141. | [64716] Apache XML Security for C++ spoofing
  3142. | [64701] Apache CXF up to 2.7.3 XML Parser Memory Consumption denial of service
  3143. | [64700] Apache CloudStack up to 4.1.0 Stack-Based cross site scripting
  3144. | [64667] Apache Open For Business Project up to 10.04.04 unknown vulnerability
  3145. | [64666] Apache Open For Business Project up to 10.04.04 cross site scripting
  3146. | [9891] Apache HTTP Server 2.2.22 suEXEC Feature .htaccess information disclosure
  3147. | [64509] Apache ActiveMQ up to 5.8.0 scheduled.jsp cross site scripting
  3148. | [9826] Apache Subversion up to 1.8.0 mod_dav_svn denial of service
  3149. | [9683] Apache HTTP Server 2.4.5 mod_session_dbd denial of service
  3150. | [64485] Apache Struts up to 2.2.3.0 privilege escalation
  3151. | [9568] Apache Struts up to 2.3.15 DefaultActionMapper cross site request forgery
  3152. | [9567] Apache Struts up to 2.3.15 DefaultActionMapper memory corruption
  3153. | [64467] Apache Geronimo 3.0 memory corruption
  3154. | [64466] Apache OpenJPA up to 2.2.1 Serialization memory corruption
  3155. | [64457] Apache Struts up to 2.2.3.0 cross site scripting
  3156. | [64326] Alejandro Garza Apachesolr Autocomplete up to 7.x-1.1 cross site scripting
  3157. | [9184] Apache Qpid up to 0.20 SSL misconfiguration
  3158. | [8935] Apache Subversion up to 1.7.9 FSFS Format Repository denial of service
  3159. | [8934] Apache Subversion up to 1.7.9 Svnserve Server denial of service
  3160. | [8933] Apache Subversion up to 1.6.21 check-mime-type.pl svnlook memory corruption
  3161. | [8932] Apache Subversion up to 1.6.21 svn-keyword-check.pl svnlook changed memory corruption
  3162. | [9022] Apache Struts up to 2.3.14.2 OGNL Expression memory corruption
  3163. | [8873] Apache Struts 2.3.14 privilege escalation
  3164. | [8872] Apache Struts 2.3.14 privilege escalation
  3165. | [8746] Apache HTTP Server Log File Terminal Escape Sequence Filtering mod_rewrite.c do_rewritelog privilege escalation
  3166. | [8666] Apache Tomcat up to 7.0.32 AsyncListener information disclosure
  3167. | [8665] Apache Tomcat up to 7.0.29 Chunked Transfer Encoding Extension Size denial of service
  3168. | [8664] Apache Tomcat up to 7.0.32 FORM Authentication weak authentication
  3169. | [64075] Apache Subversion up to 1.7.7 mod_dav_svn Crash denial of service
  3170. | [64074] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
  3171. | [64073] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
  3172. | [64072] Apache Subversion up to 1.7.7 mod_dav_svn NULL Pointer Dereference denial of service
  3173. | [64071] Apache Subversion up to 1.7.8 mod_dav_svn Memory Consumption denial of service
  3174. | [8768] Apache Struts up to 2.3.14 on Mac EL and OGNL Interpreter memory corruption
  3175. | [64006] Apache ActiveMQ up to 5.7.0 denial of service
  3176. | [64005] Apache ActiveMQ up to 5.7.0 Default Configuration denial of service
  3177. | [64004] Apache ActiveMQ up to 5.7.0 PortfolioPublishServlet.java cross site scripting
  3178. | [8427] Apache Tomcat Session Transaction weak authentication
  3179. | [63960] Apache Maven 3.0.4 Default Configuration spoofing
  3180. | [63751] Apache qpid up to 0.20 qpid::framing::Buffer denial of service
  3181. | [63750] Apache qpid up to 0.20 checkAvailable denial of service
  3182. | [63749] Apache Qpid up to 0.20 Memory Consumption denial of service
  3183. | [63748] Apache Qpid up to 0.20 Default Configuration denial of service
  3184. | [63747] Apache Rave up to 0.20 User Account information disclosure
  3185. | [7889] Apache Subversion up to 1.6.17 mod_dav_svn/svn_fs_file_length() denial of service
  3186. | [63646] Apache HTTP Server up to 2.2.23/2.4.3 mod_proxy_balancer.c balancer_handler cross site scripting
  3187. | [7688] Apache CXF up to 2.7.1 WSS4JInterceptor Bypass weak authentication
  3188. | [7687] Apache CXF up to 2.7.2 Token weak authentication
  3189. | [63334] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
  3190. | [63299] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
  3191. | [7202] Apache HTTP Server 2.4.2 on Oracle Solaris ld_library_path cross site scripting
  3192. | [7075] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector NioEndpoint.java denial of service
  3193. | [7074] Apache Tomcat up to 6.0.35/7.0.29 FORM Authentication RealmBase.java weak authentication
  3194. | [7073] Apache Tomcat up to 6.0.35/7.0.31 CSRF Prevention Filter cross site request forgery
  3195. | [63090] Apache Tomcat up to 4.1.24 denial of service
  3196. | [63089] Apache HTTP Server up to 2.2.13 mod_proxy_ajp denial of service
  3197. | [62933] Apache Tomcat up to 5.5.0 Access Restriction unknown vulnerability
  3198. | [62929] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector Memory Consumption denial of service
  3199. | [62833] Apache CXF -/2.6.0 spoofing
  3200. | [62832] Apache Axis2 up to 1.6.2 spoofing
  3201. | [62831] Apache Axis up to 1.4 Java Message Service spoofing
  3202. | [62830] Apache Commons-httpclient 3.0 Payments spoofing
  3203. | [62826] Apache Libcloud up to 0.11.0 spoofing
  3204. | [62757] Apache Open For Business Project up to 10.04.0 unknown vulnerability
  3205. | [8830] Red Hat JBoss Enterprise Application Platform 6.0.1 org.apache.catalina.connector.Response.encodeURL information disclosure
  3206. | [62661] Apache Axis2 unknown vulnerability
  3207. | [62658] Apache Axis2 unknown vulnerability
  3208. | [62467] Apache Qpid up to 0.17 denial of service
  3209. | [62417] Apache CXF 2.4.7/2.4.8/2.5.3/2.5.4/2.6.1 spoofing
  3210. | [6301] Apache HTTP Server mod_pagespeed cross site scripting
  3211. | [6300] Apache HTTP Server mod_pagespeed Hostname information disclosure
  3212. | [6123] Apache Wicket up to 1.5.7 Ajax Link cross site scripting
  3213. | [62035] Apache Struts up to 2.3.4 denial of service
  3214. | [61916] Apache QPID 0.5/0.6/0.14/0.16 unknown vulnerability
  3215. | [6998] Apache Tomcat 5.5.35/6.0.35/7.0.28 DIGEST Authentication Session State Caching privilege escalation
  3216. | [6997] Apache Tomcat 5.5.35/6.0.35/7.0.28 HTTP Digest Authentication Implementation privilege escalation
  3217. | [6092] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_ajp.c information disclosure
  3218. | [6090] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_http.c information disclosure
  3219. | [61507] Apache POI up to 3.8 UnhandledDataStructure denial of service
  3220. | [6070] Apache Struts up to 2.3.4 Token Name Configuration Parameter privilege escalation
  3221. | [6069] Apache Struts up to 2.3.4 Request Parameter OGNL Expression denial of service
  3222. | [5764] Oracle Solaris 10 Apache HTTP Server information disclosure
  3223. | [5700] Oracle Secure Backup 10.3.0.3/10.4.0.1 Apache denial of service
  3224. | [61255] Apache Hadoop 2.0.0 Kerberos unknown vulnerability
  3225. | [61229] Apache Sling up to 2.1.1 denial of service
  3226. | [61152] Apache Commons-compress 1.0/1.1/1.2/1.3/1.4 denial of service
  3227. | [61094] Apache Roller up to 5.0 cross site scripting
  3228. | [61093] Apache Roller up to 5.0 cross site request forgery
  3229. | [61005] Apache OpenOffice 3.3/3.4 unknown vulnerability
  3230. | [9673] Apache HTTP Server up to 2.4.4 mod_dav mod_dav.c Request denial of service
  3231. | [5436] Apache OpenOffice 3.3/3.4 WPXContentListener.cpp _closeTableRow File memory corruption
  3232. | [5435] Apache OpenOffice 3.3/3.4 vclmi.dll File memory corruption
  3233. | [60730] PHP 5.4.0/5.4.1/5.4.2 apache_request_headers memory corruption
  3234. | [60708] Apache Qpid 0.12 unknown vulnerability
  3235. | [5032] Apache Hadoop up to 0.20.205.0/1.0.1/0.23.1 Kerberos/MapReduce Security Feature privilege escalation
  3236. | [4949] Apache Struts File Upload XSLTResult.java XSLT File privilege escalation
  3237. | [4955] Apache Traffic Server 3.0.3/3.1.2 HTTP Header Parser memory corruption
  3238. | [4882] Apache Wicket up to 1.5.4 directory traversal
  3239. | [4881] Apache Wicket up to 1.4.19 cross site scripting
  3240. | [4884] Apache HTTP Server up to 2.3.6 mod_fcgid fcgid_spawn_ctl.c FcgidMaxProcessesPerClass HTTP Requests denial of service
  3241. | [60352] Apache Struts up to 2.2.3 memory corruption
  3242. | [60153] Apache Portable Runtime up to 1.4.3 denial of service
  3243. | [4598] Apache Struts 1.3.10 upload-submit.do cross site scripting
  3244. | [4597] Apache Struts 1.3.10 processSimple.do cross site scripting
  3245. | [4596] Apache Struts 2.0.14/2.2.3 struts2-rest-showcase/orders cross site scripting
  3246. | [4595] Apache Struts 2.0.14/2.2.3 struts2-showcase/person/editPerson.action cross site scripting
  3247. | [4583] Apache HTTP Server up to 2.2.21 Threaded MPM denial of service
  3248. | [4582] Apache HTTP Server up to 2.2.21 protocol.c information disclosure
  3249. | [4571] Apache Struts up to 2.3.1.2 privilege escalation
  3250. | [4557] Apache Tomcat up to 7.0.21 Caching/Recycling information disclosure
  3251. | [59934] Apache Tomcat up to 6.0.9 DigestAuthenticator.java unknown vulnerability
  3252. | [59933] Apache Tomcat up to 6.0.9 Access Restriction unknown vulnerability
  3253. | [59932] Apache Tomcat up to 6.0.9 unknown vulnerability
  3254. | [59931] Apache Tomcat up to 6.0.9 Access Restriction information disclosure
  3255. | [59902] Apache Struts up to 2.2.3 Interfaces unknown vulnerability
  3256. | [4528] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
  3257. | [4527] Apache Struts up to 2.2.3 ExceptionDelegator cross site scripting
  3258. | [59888] Apache Tomcat up to 6.0.6 denial of service
  3259. | [59886] Apache ActiveMQ up to 5.5.1 Crash denial of service
  3260. | [4513] Apache Struts up to 2.3.1 ParameterInterceptor directory traversal
  3261. | [4512] Apache Struts up to 2.2.3 CookieInterceptor privilege escalation
  3262. | [59850] Apache Geronimo up to 2.2.1 denial of service
  3263. | [59825] Apache HTTP Server up to 2.1.7 mod_reqtimeout denial of service
  3264. | [59556] Apache HTTP Server up to 2.0.53 mod_proxy information disclosure
  3265. | [58467] Apache libcloud 0.2.0/0.3.0/0.3.1/0.4.0 Access Restriction spoofing
  3266. | [58413] Apache Tomcat up to 6.0.10 spoofing
  3267. | [58381] Apache Wicket up to 1.4.17 cross site scripting
  3268. | [58296] Apache Tomcat up to 7.0.19 unknown vulnerability
  3269. | [57888] Apache HttpClient 4.0/4.0.1/4.1 Authorization information disclosure
  3270. | [57587] Apache Subversion up to 1.6.16 mod_dav_svn information disclosure
  3271. | [57585] Apache Subversion up to 1.6.16 mod_dav_svn Memory Consumption denial of service
  3272. | [57584] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
  3273. | [57577] Apache Rampart-C 1.3.0 Access Restriction rampart_timestamp_token_validate privilege escalation
  3274. | [57568] Apache Archiva up to 1.3.4 cross site scripting
  3275. | [57567] Apache Archiva up to 1.3.4 cross site request forgery
  3276. | [57481] Apache Tomcat 7.0.12/7.0.13 Access Restriction unknown vulnerability
  3277. | [4355] Apache HTTP Server APR apr_fnmatch denial of service
  3278. | [57435] Apache Struts up to 2.2.1.1 FileHandler.java cross site scripting
  3279. | [57425] Apache Struts up to 2.2.1.1 cross site scripting
  3280. | [4352] Apache HTTP Server 2.2.x APR apr_fnmatch denial of service
  3281. | [57025] Apache Tomcat up to 7.0.11 information disclosure
  3282. | [57024] Apache Tomcat 7.0.11 Access Restriction information disclosure
  3283. | [56774] IBM WebSphere Application Server up to 7.0.0.14 org.apache.jasper.runtime.JspWriterImpl.response denial of service
  3284. | [56824] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
  3285. | [56832] Apache Tomcat up to 7.0.10 Access Restriction information disclosure
  3286. | [56830] Apache Tomcat up to 7.0.9 Access Restriction privilege escalation
  3287. | [12440] Apache Tomcat 6.0.33 Malicious Request cross site scripting
  3288. | [56512] Apache Continuum up to 1.4.0 cross site scripting
  3289. | [4285] Apache Tomcat 5.x JVM getLocale denial of service
  3290. | [4284] Apache Tomcat 5.x HTML Manager Infinite Loop cross site scripting
  3291. | [4283] Apache Tomcat 5.x ServletContect privilege escalation
  3292. | [56441] Apache Tomcat up to 7.0.6 denial of service
  3293. | [56300] Apache CouchDB up to 1.0.1 Web Administration Interface cross site scripting
  3294. | [55967] Apache Subversion up to 1.6.4 rev_hunt.c denial of service
  3295. | [55966] Apache Subversion up to 1.6.4 mod_dav_svn repos.c walk denial of service
  3296. | [55095] Apache Axis2 up to 1.6 Default Password memory corruption
  3297. | [55631] Apache Archiva up to 1.3.1 User Account cross site request forgery
  3298. | [55556] Apache Tomcat up to 6.0.29 Default Configuration information disclosure
  3299. | [55553] Apache Tomcat up to 7.0.4 sessionsList.jsp cross site scripting
  3300. | [55162] Apache MyFaces up to 2.0.0 Authentication Code unknown vulnerability
  3301. | [54881] Apache Subversion up to 1.6.12 mod_dav_svn authz.c privilege escalation
  3302. | [54879] Apache APR-util up to 0.9.14 mod_reqtimeout apr_brigade_split_line denial of service
  3303. | [54693] Apache Traffic Server DNS Cache unknown vulnerability
  3304. | [54416] Apache CouchDB up to 0.11.0 cross site request forgery
  3305. | [54394] Apache CXF up to 2.2.8 Memory Consumption denial of service
  3306. | [54261] Apache Tomcat jsp/cal/cal2.jsp cross site scripting
  3307. | [54166] Apache HTTP Server up to 2.2.12 mod_cache Crash denial of service
  3308. | [54385] Apache Struts up to 2.1.8.1 ParameterInterceptor unknown vulnerability
  3309. | [54012] Apache Tomcat up to 6.0.10 denial of service
  3310. | [53763] Apache Axis2 1.3/1.4/1.4.1/1.5/1.5.1 Memory Consumption denial of service
  3311. | [53368] Apache MyFaces 1.1.7/1.2.8 cross site scripting
  3312. | [53397] Apache axis2 1.4.1/1.5.1 Administration Console cross site scripting
  3313. | [52894] Apache Tomcat up to 6.0.7 information disclosure
  3314. | [52960] Apache ActiveMQ up to 5.4-snapshot information disclosure
  3315. | [52843] Apache HTTP Server mod_auth_shadow unknown vulnerability
  3316. | [52786] Apache Open For Business Project up to 09.04 cross site scripting
  3317. | [52587] Apache ActiveMQ up to 5.3.0 cross site request forgery
  3318. | [52586] Apache ActiveMQ up to 5.3.0 cross site scripting
  3319. | [52584] Apache CouchDB up to 0.10.1 information disclosure
  3320. | [51757] Apache HTTP Server 2.0.44 cross site scripting
  3321. | [51756] Apache HTTP Server 2.0.44 spoofing
  3322. | [51717] Apache HTTP Server up to 1.3.3 mod_proxy ap_proxy_send_fb memory corruption
  3323. | [51690] Apache Tomcat up to 6.0 directory traversal
  3324. | [51689] Apache Tomcat up to 6.0 information disclosure
  3325. | [51688] Apache Tomcat up to 6.0 directory traversal
  3326. | [50886] HP Operations Manager 8.10 on Windows File Upload org.apache.catalina.manager.HTMLManagerServlet memory corruption
  3327. | [50802] Apache Tomcat up to 3.3 Default Password weak authentication
  3328. | [50626] Apache Solr 1.0.0 cross site scripting
  3329. | [49857] Apache HTTP Server mod_proxy_ftp cross site scripting
  3330. | [49856] Apache HTTP Server 2.2.13 mod_proxy_ftp ap_proxy_ftp_handler denial of service
  3331. | [49348] Apache Xerces-C++ 2.7.0 Stack-Based denial of service
  3332. | [86789] Apache Portable Runtime memory/unix/apr_pools.c unknown vulnerability
  3333. | [49283] Apache APR-util up to 1.3.8 apr-util misc/apr_rmm.c apr_rmm_realloc memory corruption
  3334. | [48952] Apache HTTP Server up to 1.3.6 mod_deflate denial of service
  3335. | [48626] Apache Tomcat up to 4.1.23 Access Restriction directory traversal
  3336. | [48431] Apache Tomcat up to 4.1.23 j_security_check cross site scripting
  3337. | [48430] Apache Tomcat up to 4.1.23 mod_jk denial of service
  3338. | [47801] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site request forgery
  3339. | [47800] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site scripting
  3340. | [47799] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console directory traversal
  3341. | [47648] Apache Tiles 2.1.0/2.1.1 cross site scripting
  3342. | [47640] Apache Struts 2.0.6/2.0.8/2.0.9/2.0.11/2.1 cross site scripting
  3343. | [47638] Apache Tomcat up to 4.1.23 mod_jk information disclosure
  3344. | [47636] Apache Struts 2.0.9 xip_client.html cross site scripting
  3345. | [47593] Apache Mod Perl 1 perl-status Apache::Status cross site scripting
  3346. | [47637] Apache Struts 1.0.2/1.1/1.2.4/1.2.7/1.2.8 cross site scripting
  3347. | [47239] Apache Struts up to 2.1.2 Beta struts directory traversal
  3348. | [47214] Apachefriends xampp 1.6.8 spoofing
  3349. | [47213] Apachefriends xampp 1.6.8 htaccess cross site request forgery
  3350. | [47162] Apachefriends XAMPP 1.4.4 weak authentication
  3351. | [47065] Apache Tomcat 4.1.23 cross site scripting
  3352. | [46834] Apache Tomcat up to 5.5.20 cross site scripting
  3353. | [46004] Apache Jackrabbit 1.4/1.5.0 search.jsp cross site scripting
  3354. | [49205] Apache Roller 2.3/3.0/3.1/4.0 Search cross site scripting
  3355. | [86625] Apache Struts directory traversal
  3356. | [44461] Apache Tomcat up to 5.5.0 information disclosure
  3357. | [44389] Apache Xerces-C++ XML Parser Memory Consumption denial of service
  3358. | [44352] Apache Friends XAMPP 1.6.8 adodb.php cross site scripting
  3359. | [43663] Apache Tomcat up to 6.0.16 directory traversal
  3360. | [43612] Apache Friends XAMPP 1.6.7 iart.php cross site scripting
  3361. | [43556] Apache HTTP Server up to 2.1.8 mod_proxy_ftp proxy_ftp.c cross site scripting
  3362. | [43516] Apache Tomcat up to 4.1.20 directory traversal
  3363. | [43509] Apache Tomcat up to 6.0.13 cross site scripting
  3364. | [42637] Apache Tomcat up to 6.0.16 cross site scripting
  3365. | [42325] Apache HTTP Server up to 2.1.8 Error Page cross site scripting
  3366. | [41838] Apache-SSL 1.3.34 1.57 expandcert privilege escalation
  3367. | [41091] Apache Software Foundation Mod Jk up to 2.0.1 mod_jk2 Stack-based memory corruption
  3368. | [40924] Apache Tomcat up to 6.0.15 information disclosure
  3369. | [40923] Apache Tomcat up to 6.0.15 unknown vulnerability
  3370. | [40922] Apache Tomcat up to 6.0 information disclosure
  3371. | [40710] Apache HTTP Server up to 2.0.61 mod_negotiation cross site scripting
  3372. | [40709] Apache HTTP Server up to 2.0.53 mod_negotiation cross site scripting
  3373. | [40656] Apache Tomcat 5.5.20 information disclosure
  3374. | [40503] Apache HTTP Server mod_proxy_ftp cross site scripting
  3375. | [40502] Apache HTTP Server up to 2.2.5 mod_proxy_balancer memory corruption
  3376. | [40501] Apache HTTP Server 2.2.6 mod_proxy_balancer cross site request forgery
  3377. | [40398] Apache HTTP Server up to 2.2 mod_proxy_balancer cross site scripting
  3378. | [40397] Apache HTTP Server up to 2.2 mod_proxy_balancer balancer_handler denial of service
  3379. | [40234] Apache Tomcat up to 6.0.15 directory traversal
  3380. | [40221] Apache HTTP Server 2.2.6 information disclosure
  3381. | [40027] David Castro Apache Authcas 0.4 sql injection
  3382. | [3495] Apache OpenOffice up to 2.3 Database Document Processor unknown vulnerability
  3383. | [3489] Apache HTTP Server 2.x HTTP Header cross site scripting
  3384. | [3414] Apache Tomcat WebDAV Stored privilege escalation
  3385. | [39489] Apache Jakarta Slide up to 2.1 directory traversal
  3386. | [39540] Apache Geronimo 2.0/2.0.1/2.0.2/2.1 unknown vulnerability
  3387. | [3310] Apache OpenOffice 1.1.3/2.0.4/2.2.1 TIFF Image Parser Heap-based memory corruption
  3388. | [38768] Apache HTTP Server up to 2.1.7 mod_autoindex.c cross site scripting
  3389. | [38952] Apache Geronimo 2.0.1/2.1 unknown vulnerability
  3390. | [38658] Apache Tomcat 4.1.31 cal2.jsp cross site request forgery
  3391. | [38524] Apache Geronimo 2.0 unknown vulnerability
  3392. | [3256] Apache Tomcat up to 6.0.13 cross site scripting
  3393. | [38331] Apache Tomcat 4.1.24 information disclosure
  3394. | [38330] Apache Tomcat 4.1.24 information disclosure
  3395. | [38185] Apache Tomcat 3.3/3.3.1/3.3.1a/3.3.2 Error Message CookieExample cross site scripting
  3396. | [37967] Apache Tomcat up to 4.1.36 Error Message sendmail.jsp cross site scripting
  3397. | [37647] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 Authorization unknown vulnerability
  3398. | [37646] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 unknown vulnerability
  3399. | [3141] Apache Tomcat up to 4.1.31 Accept-Language Header cross site scripting
  3400. | [3133] Apache Tomcat up to 6.0 HTTP cross site scripting
  3401. | [37292] Apache Tomcat up to 5.5.1 cross site scripting
  3402. | [3130] Apache OpenOffice 2.2.1 RTF Document Heap-based memory corruption
  3403. | [36981] Apache Tomcat JK Web Server Connector up to 1.2.22 mod_jk directory traversal
  3404. | [36892] Apache Tomcat up to 4.0.0 hello.jsp cross site scripting
  3405. | [37320] Apache MyFaces Tomahawk up to 1.1.4 cross site scripting
  3406. | [36697] Apache Tomcat up to 5.5.17 implicit-objects.jsp cross site scripting
  3407. | [36491] Apache Axis 1.0 Installation javaioFileNotFoundException information disclosure
  3408. | [36400] Apache Tomcat 5.5.15 mod_jk cross site scripting
  3409. | [36698] Apache Tomcat up to 4.0.0 cal2.jsp cross site scripting
  3410. | [36224] XAMPP Apache Distribution up to 1.6.0a adodb.php connect memory corruption
  3411. | [36225] XAMPP Apache Distribution 1.6.0a sql injection
  3412. | [2997] Apache httpd/Tomcat 5.5/6.0 directory traversal
  3413. | [35896] Apache Apache Test up to 1.29 mod_perl denial of service
  3414. | [35653] Avaya S8300 Cm 3.1.2 Apache Tomcat unknown vulnerability
  3415. | [35402] Apache Tomcat JK Web Server Connector 1.2.19 mod_jk.so map_uri_to_worker memory corruption
  3416. | [35067] Apache Stats up to 0.0.2 extract unknown vulnerability
  3417. | [35025] Apache Stats up to 0.0.3 extract unknown vulnerability
  3418. | [34252] Apache HTTP Server denial of service
  3419. | [2795] Apache OpenOffice 2.0.4 WMF/EMF File Heap-based memory corruption
  3420. | [33877] Apache Opentaps 0.9.3 cross site scripting
  3421. | [33876] Apache Open For Business Project unknown vulnerability
  3422. | [33875] Apache Open For Business Project cross site scripting
  3423. | [2703] Apache Jakarta Tomcat up to 5.x der_get_oid memory corruption
  3424. | [2611] Apache HTTP Server up to 1.0.1 set_var Format String
  3425. |
  3426. | MITRE CVE - https://cve.mitre.org:
  3427. | [CVE-2013-4156] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.
  3428. | [CVE-2013-4131] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.
  3429. | [CVE-2013-3239] phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
  3430. | [CVE-2013-3060] The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
  3431. | [CVE-2013-2765] The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
  3432. | [CVE-2013-2251] Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
  3433. | [CVE-2013-2249] mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.
  3434. | [CVE-2013-2248] Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
  3435. | [CVE-2013-2189] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
  3436. | [CVE-2013-2135] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
  3437. | [CVE-2013-2134] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
  3438. | [CVE-2013-2115] Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
  3439. | [CVE-2013-2071] java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
  3440. | [CVE-2013-2067] java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
  3441. | [CVE-2013-1966] Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
  3442. | [CVE-2013-1965] Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
  3443. | [CVE-2013-1896] mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
  3444. | [CVE-2013-1884] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
  3445. | [CVE-2013-1879] Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
  3446. | [CVE-2013-1862] mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
  3447. | [CVE-2013-1849] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
  3448. | [CVE-2013-1847] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
  3449. | [CVE-2013-1846] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
  3450. | [CVE-2013-1845] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
  3451. | [CVE-2013-1814] The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
  3452. | [CVE-2013-1777] The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not property implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
  3453. | [CVE-2013-1768] The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
  3454. | [CVE-2013-1088] Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
  3455. | [CVE-2013-1048] The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
  3456. | [CVE-2013-0966] The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
  3457. | [CVE-2013-0942] Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3458. | [CVE-2013-0941] EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
  3459. | [CVE-2013-0253] The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
  3460. | [CVE-2013-0248] The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
  3461. | [CVE-2013-0239] Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
  3462. | [CVE-2012-6573] Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.
  3463. | [CVE-2012-6551] The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
  3464. | [CVE-2012-6092] Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js.  NOTE: AMQ-4124 is covered by CVE-2012-6551.
  3465. | [CVE-2012-5887] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
  3466. | [CVE-2012-5886] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
  3467. | [CVE-2012-5885] The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
  3468. | [CVE-2012-5786] The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
  3469. | [CVE-2012-5785] Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
  3470. | [CVE-2012-5784] Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
  3471. | [CVE-2012-5783] Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
  3472. | [CVE-2012-5633] The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
  3473. | [CVE-2012-5616] Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
  3474. | [CVE-2012-5568] Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
  3475. | [CVE-2012-5351] Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
  3476. | [CVE-2012-4558] Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
  3477. | [CVE-2012-4557] The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
  3478. | [CVE-2012-4556] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
  3479. | [CVE-2012-4555] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
  3480. | [CVE-2012-4534] org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
  3481. | [CVE-2012-4528] The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
  3482. | [CVE-2012-4501] Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
  3483. | [CVE-2012-4460] The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.  NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
  3484. | [CVE-2012-4459] Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
  3485. | [CVE-2012-4458] The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
  3486. | [CVE-2012-4446] The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
  3487. | [CVE-2012-4431] org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
  3488. | [CVE-2012-4418] Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
  3489. | [CVE-2012-4387] Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
  3490. | [CVE-2012-4386] The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
  3491. | [CVE-2012-4360] Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3492. | [CVE-2012-4063] The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, which allows remote attackers to cause a denial of service via unspecified vectors.
  3493. | [CVE-2012-4001] The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
  3494. | [CVE-2012-3908] Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
  3495. | [CVE-2012-3546] org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
  3496. | [CVE-2012-3544] Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
  3497. | [CVE-2012-3526] The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
  3498. | [CVE-2012-3513] munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
  3499. | [CVE-2012-3506] Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
  3500. | [CVE-2012-3502] The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
  3501. | [CVE-2012-3499] Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
  3502. | [CVE-2012-3467] Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
  3503. | [CVE-2012-3451] Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
  3504. | [CVE-2012-3446] Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
  3505. | [CVE-2012-3376] DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
  3506. | [CVE-2012-3373] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
  3507. | [CVE-2012-3126] Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Apache Tomcat Agent.
  3508. | [CVE-2012-3123] Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, related to Apache HTTP Server.
  3509. | [CVE-2012-2760] mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
  3510. | [CVE-2012-2733] java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
  3511. | [CVE-2012-2687] Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
  3512. | [CVE-2012-2381] Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
  3513. | [CVE-2012-2380] Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
  3514. | [CVE-2012-2379] Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
  3515. | [CVE-2012-2378] Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
  3516. | [CVE-2012-2329] Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
  3517. | [CVE-2012-2145] Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
  3518. | [CVE-2012-2138] The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
  3519. | [CVE-2012-2098] Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
  3520. | [CVE-2012-1574] The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
  3521. | [CVE-2012-1181] fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
  3522. | [CVE-2012-1089] Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.
  3523. | [CVE-2012-1007] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
  3524. | [CVE-2012-1006] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
  3525. | [CVE-2012-0883] envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
  3526. | [CVE-2012-0840] tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
  3527. | [CVE-2012-0838] Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
  3528. | [CVE-2012-0788] The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
  3529. | [CVE-2012-0394] ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors.  NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
  3530. | [CVE-2012-0393] The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
  3531. | [CVE-2012-0392] The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
  3532. | [CVE-2012-0391] The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
  3533. | [CVE-2012-0256] Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
  3534. | [CVE-2012-0216] The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
  3535. | [CVE-2012-0213] The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
  3536. | [CVE-2012-0053] protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
  3537. | [CVE-2012-0047] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.
  3538. | [CVE-2012-0031] scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
  3539. | [CVE-2012-0022] Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
  3540. | [CVE-2012-0021] The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
  3541. | [CVE-2011-5064] DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
  3542. | [CVE-2011-5063] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
  3543. | [CVE-2011-5062] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
  3544. | [CVE-2011-5057] Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces.  NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
  3545. | [CVE-2011-5034] Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.  NOTE: this might overlap CVE-2011-4461.
  3546. | [CVE-2011-4905] Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.
  3547. | [CVE-2011-4858] Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
  3548. | [CVE-2011-4668] IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
  3549. | [CVE-2011-4449] actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
  3550. | [CVE-2011-4415] The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
  3551. | [CVE-2011-4317] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
  3552. | [CVE-2011-3639] The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
  3553. | [CVE-2011-3620] Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
  3554. | [CVE-2011-3607] Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
  3555. | [CVE-2011-3376] org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
  3556. | [CVE-2011-3375] Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
  3557. | [CVE-2011-3368] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
  3558. | [CVE-2011-3348] The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
  3559. | [CVE-2011-3192] The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
  3560. | [CVE-2011-3190] Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
  3561. | [CVE-2011-2729] native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
  3562. | [CVE-2011-2712] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
  3563. | [CVE-2011-2688] SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
  3564. | [CVE-2011-2526] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
  3565. | [CVE-2011-2516] Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
  3566. | [CVE-2011-2481] Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.  NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
  3567. | [CVE-2011-2329] The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expired token, a different vulnerability than CVE-2011-0730.
  3568. | [CVE-2011-2204] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
  3569. | [CVE-2011-2088] XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
  3570. | [CVE-2011-2087] Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
  3571. | [CVE-2011-1928] The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used.  NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
  3572. | [CVE-2011-1921] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
  3573. | [CVE-2011-1783] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.
  3574. | [CVE-2011-1772] Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
  3575. | [CVE-2011-1752] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
  3576. | [CVE-2011-1610] Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
  3577. | [CVE-2011-1582] Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
  3578. | [CVE-2011-1571] Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
  3579. | [CVE-2011-1570] Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
  3580. | [CVE-2011-1503] The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
  3581. | [CVE-2011-1502] Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
  3582. | [CVE-2011-1498] Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
  3583. | [CVE-2011-1475] The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
  3584. | [CVE-2011-1419] Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
  3585. | [CVE-2011-1318] Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application that is repeatedly stopped and restarted.
  3586. | [CVE-2011-1184] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
  3587. | [CVE-2011-1183] Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
  3588. | [CVE-2011-1176] The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
  3589. | [CVE-2011-1088] Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
  3590. | [CVE-2011-1077] Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3591. | [CVE-2011-1026] Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.
  3592. | [CVE-2011-0715] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
  3593. | [CVE-2011-0534] Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
  3594. | [CVE-2011-0533] Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta
  3595. | [CVE-2011-0419] Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
  3596. | [CVE-2011-0013] Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
  3597. | [CVE-2010-4644] Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
  3598. | [CVE-2010-4539] The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
  3599. | [CVE-2010-4476] The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
  3600. | [CVE-2010-4455] Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.2 and 11.1.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Apache Plugin.
  3601. | [CVE-2010-4408] Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
  3602. | [CVE-2010-4312] The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
  3603. | [CVE-2010-4172] Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
  3604. | [CVE-2010-3872] The fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."
  3605. | [CVE-2010-3863] Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
  3606. | [CVE-2010-3854] Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3607. | [CVE-2010-3718] Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
  3608. | [CVE-2010-3449] Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1
  3609. | [CVE-2010-3315] authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
  3610. | [CVE-2010-3083] sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
  3611. | [CVE-2010-2952] Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.
  3612. | [CVE-2010-2791] mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.  NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
  3613. | [CVE-2010-2375] Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
  3614. | [CVE-2010-2234] Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
  3615. | [CVE-2010-2227] Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
  3616. | [CVE-2010-2103] Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter.  NOTE: some of these details are obtained from third party information.
  3617. | [CVE-2010-2086] Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
  3618. | [CVE-2010-2076] Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
  3619. | [CVE-2010-2068] mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
  3620. | [CVE-2010-2057] shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
  3621. | [CVE-2010-1632] Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
  3622. | [CVE-2010-1623] Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
  3623. | [CVE-2010-1587] The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
  3624. | [CVE-2010-1452] The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
  3625. | [CVE-2010-1325] Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting.  NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.
  3626. | [CVE-2010-1244] Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
  3627. | [CVE-2010-1157] Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
  3628. | [CVE-2010-1151] Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
  3629. | [CVE-2010-0684] Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
  3630. | [CVE-2010-0434] The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
  3631. | [CVE-2010-0432] Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
  3632. | [CVE-2010-0425] modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
  3633. | [CVE-2010-0408] The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
  3634. | [CVE-2010-0390] Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension, then accessing it via a direct request to the file in original/.  NOTE: some of these details are obtained from third party information.
  3635. | [CVE-2010-0219] Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
  3636. | [CVE-2010-0010] Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
  3637. | [CVE-2010-0009] Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
  3638. | [CVE-2009-5120] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
  3639. | [CVE-2009-5119] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
  3640. | [CVE-2009-5006] The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.
  3641. | [CVE-2009-5005] The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
  3642. | [CVE-2009-4355] Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
  3643. | [CVE-2009-4269] The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
  3644. | [CVE-2009-3923] The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.
  3645. | [CVE-2009-3890] Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
  3646. | [CVE-2009-3843] HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
  3647. | [CVE-2009-3821] Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3648. | [CVE-2009-3555] The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
  3649. | [CVE-2009-3548] The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
  3650. | [CVE-2009-3250] The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.
  3651. | [CVE-2009-3095] The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
  3652. | [CVE-2009-3094] The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
  3653. | [CVE-2009-2902] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
  3654. | [CVE-2009-2901] The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
  3655. | [CVE-2009-2823] The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.
  3656. | [CVE-2009-2699] The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
  3657. | [CVE-2009-2696] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
  3658. | [CVE-2009-2693] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
  3659. | [CVE-2009-2625] XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
  3660. | [CVE-2009-2412] Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR
  3661. | [CVE-2009-2299] The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
  3662. | [CVE-2009-1956] Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
  3663. | [CVE-2009-1955] The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
  3664. | [CVE-2009-1903] The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
  3665. | [CVE-2009-1891] The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
  3666. | [CVE-2009-1890] The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
  3667. | [CVE-2009-1885] Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
  3668. | [CVE-2009-1462] The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
  3669. | [CVE-2009-1275] Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
  3670. | [CVE-2009-1195] The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
  3671. | [CVE-2009-1191] mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
  3672. | [CVE-2009-1012] Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
  3673. | [CVE-2009-0918] Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
  3674. | [CVE-2009-0796] Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
  3675. | [CVE-2009-0783] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
  3676. | [CVE-2009-0781] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
  3677. | [CVE-2009-0754] PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
  3678. | [CVE-2009-0580] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
  3679. | [CVE-2009-0486] Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
  3680. | [CVE-2009-0039] Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
  3681. | [CVE-2009-0038] Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring
  3682. | [CVE-2009-0033] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
  3683. | [CVE-2009-0026] Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
  3684. | [CVE-2009-0023] The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
  3685. | [CVE-2008-6879] Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
  3686. | [CVE-2008-6755] ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
  3687. | [CVE-2008-6722] Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
  3688. | [CVE-2008-6682] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
  3689. | [CVE-2008-6505] Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
  3690. | [CVE-2008-6504] ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
  3691. | [CVE-2008-5696] Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
  3692. | [CVE-2008-5676] Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
  3693. | [CVE-2008-5519] The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
  3694. | [CVE-2008-5518] Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet)
  3695. | [CVE-2008-5515] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
  3696. | [CVE-2008-5457] Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
  3697. | [CVE-2008-4308] The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
  3698. | [CVE-2008-4008] Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
  3699. | [CVE-2008-3666] Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call, as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured
  3700. | [CVE-2008-3271] Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
  3701. | [CVE-2008-3257] Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
  3702. | [CVE-2008-2939] Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
  3703. | [CVE-2008-2938] Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
  3704. | [CVE-2008-2742] Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory.  NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the mod_mime module enabled.
  3705. | [CVE-2008-2717] TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
  3706. | [CVE-2008-2579] Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors.
  3707. | [CVE-2008-2384] SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
  3708. | [CVE-2008-2370] Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
  3709. | [CVE-2008-2364] The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
  3710. | [CVE-2008-2168] Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
  3711. | [CVE-2008-2025] Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
  3712. | [CVE-2008-1947] Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
  3713. | [CVE-2008-1734] Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
  3714. | [CVE-2008-1678] Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
  3715. | [CVE-2008-1232] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
  3716. | [CVE-2008-0869] Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
  3717. | [CVE-2008-0732] The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
  3718. | [CVE-2008-0555] The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.
  3719. | [CVE-2008-0457] Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
  3720. | [CVE-2008-0456] CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
  3721. | [CVE-2008-0455] Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
  3722. | [CVE-2008-0128] The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
  3723. | [CVE-2008-0005] mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
  3724. | [CVE-2008-0002] Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
  3725. | [CVE-2007-6750] The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
  3726. | [CVE-2007-6726] Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
  3727. | [CVE-2007-6514] Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.
  3728. | [CVE-2007-6423] ** DISPUTED **  Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL.  NOTE: the vendor could not reproduce this issue.
  3729. | [CVE-2007-6422] The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.
  3730. | [CVE-2007-6421] Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
  3731. | [CVE-2007-6420] Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
  3732. | [CVE-2007-6388] Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3733. | [CVE-2007-6361] Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries.  NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
  3734. | [CVE-2007-6342] SQL injection vulnerability in the David Castro AuthCAS module (AuthCAS.pm) 0.4 for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the SESSION_COOKIE_NAME (session ID) in a cookie.
  3735. | [CVE-2007-6286] Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
  3736. | [CVE-2007-6258] Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.
  3737. | [CVE-2007-6231] Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/.  NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
  3738. | [CVE-2007-6203] Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
  3739. | [CVE-2007-5797] SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
  3740. | [CVE-2007-5731] Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
  3741. | [CVE-2007-5461] Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
  3742. | [CVE-2007-5342] The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
  3743. | [CVE-2007-5333] Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
  3744. | [CVE-2007-5156] Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
  3745. | [CVE-2007-5085] Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.
  3746. | [CVE-2007-5000] Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
  3747. | [CVE-2007-4724] Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
  3748. | [CVE-2007-4723] Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
  3749. | [CVE-2007-4641] Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting code into an Apache log file.
  3750. | [CVE-2007-4556] Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
  3751. | [CVE-2007-4548] The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
  3752. | [CVE-2007-4465] Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset.  NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
  3753. | [CVE-2007-3847] The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
  3754. | [CVE-2007-3571] The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
  3755. | [CVE-2007-3386] Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
  3756. | [CVE-2007-3385] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
  3757. | [CVE-2007-3384] Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
  3758. | [CVE-2007-3383] Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
  3759. | [CVE-2007-3382] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
  3760. | [CVE-2007-3304] Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
  3761. | [CVE-2007-3303] Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes.  NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
  3762. | [CVE-2007-3101] Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.
  3763. | [CVE-2007-2450] Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
  3764. | [CVE-2007-2449] Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the '
  3765. | [CVE-2007-2353] Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
  3766. | [CVE-2007-2025] Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
  3767. | [CVE-2007-1863] cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
  3768. | [CVE-2007-1862] The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.
  3769. | [CVE-2007-1860] mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
  3770. | [CVE-2007-1858] The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
  3771. | [CVE-2007-1842] Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
  3772. | [CVE-2007-1801] Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
  3773. | [CVE-2007-1743] suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."  In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
  3774. | [CVE-2007-1742] suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
  3775. | [CVE-2007-1741] Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
  3776. | [CVE-2007-1720] Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
  3777. | [CVE-2007-1636] Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
  3778. | [CVE-2007-1633] Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
  3779. | [CVE-2007-1577] Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
  3780. | [CVE-2007-1539] Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter, as demonstrated via a static PHP code injection attack in an Apache log file.
  3781. | [CVE-2007-1524] Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settings[skin] parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via themes/default/.
  3782. | [CVE-2007-1491] Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.
  3783. | [CVE-2007-1358] Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
  3784. | [CVE-2007-1349] PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
  3785. | [CVE-2007-0975] Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
  3786. | [CVE-2007-0930] Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
  3787. | [CVE-2007-0792] The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
  3788. | [CVE-2007-0774] Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
  3789. | [CVE-2007-0637] Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the galeria parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by zd_numer.php.
  3790. | [CVE-2007-0451] Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
  3791. | [CVE-2007-0450] Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
  3792. | [CVE-2007-0419] The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
  3793. | [CVE-2007-0173] Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
  3794. | [CVE-2007-0098] Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
  3795. | [CVE-2007-0086] ** DISPUTED **  The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment.  NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
  3796. | [CVE-2006-7217] Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
  3797. | [CVE-2006-7216] Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
  3798. | [CVE-2006-7197] The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
  3799. | [CVE-2006-7196] Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.
  3800. | [CVE-2006-7195] Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
  3801. | [CVE-2006-7098] The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
  3802. | [CVE-2006-6869] Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
  3803. | [CVE-2006-6675] Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecifeid parameters in Welcome web-app.
  3804. | [CVE-2006-6613] Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
  3805. | [CVE-2006-6589] Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue than CVE-2006-6587. NOTE: some of these details are obtained from third party information.
  3806. | [CVE-2006-6588] The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact.
  3807. | [CVE-2006-6587] Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
  3808. | [CVE-2006-6445] Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
  3809. | [CVE-2006-6071] TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
  3810. | [CVE-2006-6047] Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
  3811. | [CVE-2006-5894] Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by lang.php.
  3812. | [CVE-2006-5752] Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.
  3813. | [CVE-2006-5733] Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
  3814. | [CVE-2006-5263] Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter, as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.
  3815. | [CVE-2006-4994] Multiple unquoted Windows search path vulnerabilities in Apache Friends XAMPP 1.5.2 might allow local users to gain privileges via a malicious program file in %SYSTEMDRIVE%, which is run when XAMPP attempts to execute (1) FileZillaServer.exe, (2) mysqld-nt.exe, (3) Perl.exe, or (4) xamppcontrol.exe with an unquoted "Program Files" pathname.
  3816. | [CVE-2006-4636] Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
  3817. | [CVE-2006-4625] PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
  3818. | [CVE-2006-4558] DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
  3819. | [CVE-2006-4191] Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by header.php.
  3820. | [CVE-2006-4154] Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.
  3821. | [CVE-2006-4110] Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
  3822. | [CVE-2006-4004] Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
  3823. | [CVE-2006-3918] http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
  3824. | [CVE-2006-3835] Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (
  3825. | [CVE-2006-3747] Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
  3826. | [CVE-2006-3362] Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
  3827. | [CVE-2006-3102] Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
  3828. | [CVE-2006-3070] write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
  3829. | [CVE-2006-2831] Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
  3830. | [CVE-2006-2806] The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
  3831. | [CVE-2006-2743] Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.
  3832. | [CVE-2006-2514] Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
  3833. | [CVE-2006-2330] PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
  3834. | [CVE-2006-1777] Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
  3835. | [CVE-2006-1564] Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.
  3836. | [CVE-2006-1548] Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
  3837. | [CVE-2006-1547] ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
  3838. | [CVE-2006-1546] Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
  3839. | [CVE-2006-1393] Multiple cross-site scripting (XSS) vulnerabilities in the mod_pubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.
  3840. | [CVE-2006-1346] Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.
  3841. | [CVE-2006-1292] Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
  3842. | [CVE-2006-1243] Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php.
  3843. | [CVE-2006-1095] Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
  3844. | [CVE-2006-1079] htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function.  NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE.  However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
  3845. | [CVE-2006-1078] Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file.  NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE.  However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
  3846. | [CVE-2006-0743] Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
  3847. | [CVE-2006-0254] Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
  3848. | [CVE-2006-0150] Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
  3849. | [CVE-2006-0144] The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
  3850. | [CVE-2006-0042] Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.
  3851. | [CVE-2005-4857] eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error".
  3852. | [CVE-2005-4849] Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
  3853. | [CVE-2005-4836] The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
  3854. | [CVE-2005-4814] Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory.
  3855. | [CVE-2005-4703] Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
  3856. | [CVE-2005-3745] Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
  3857. | [CVE-2005-3630] Fedora Directory Server before 10 allows remote attackers to obtain sensitive information, such as the password from adm.conf via an IFRAME element, probably involving an Apache httpd.conf configuration that orders "allow" directives before "deny" directives.
  3858. | [CVE-2005-3510] Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
  3859. | [CVE-2005-3392] Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
  3860. | [CVE-2005-3357] mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
  3861. | [CVE-2005-3352] Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
  3862. | [CVE-2005-3319] The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
  3863. | [CVE-2005-3164] The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
  3864. | [CVE-2005-2970] Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.
  3865. | [CVE-2005-2963] The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
  3866. | [CVE-2005-2728] The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
  3867. | [CVE-2005-2660] apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
  3868. | [CVE-2005-2088] The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
  3869. | [CVE-2005-1754] ** DISPUTED **  JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter.  NOTE: Sun and Apache dispute this issue.  Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
  3870. | [CVE-2005-1753] ** DISPUTED **  ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue.  Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
  3871. | [CVE-2005-1344] Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program.  Therefore this may not be a vulnerability.
  3872. | [CVE-2005-1268] Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
  3873. | [CVE-2005-1266] Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
  3874. | [CVE-2005-0808] Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
  3875. | [CVE-2005-0182] The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
  3876. | [CVE-2005-0108] Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.
  3877. | [CVE-2004-2734] webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
  3878. | [CVE-2004-2680] mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.
  3879. | [CVE-2004-2650] Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
  3880. | [CVE-2004-2343] ** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
  3881. | [CVE-2004-2336] Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
  3882. | [CVE-2004-2115] Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
  3883. | [CVE-2004-1834] mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
  3884. | [CVE-2004-1765] Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
  3885. | [CVE-2004-1545] UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.hwp, which allows remote attackers to upload and execute arbitrary code.
  3886. | [CVE-2004-1438] The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.
  3887. | [CVE-2004-1405] MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
  3888. | [CVE-2004-1404] Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
  3889. | [CVE-2004-1387] The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
  3890. | [CVE-2004-1084] Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.
  3891. | [CVE-2004-1083] Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
  3892. | [CVE-2004-1082] mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
  3893. | [CVE-2004-0942] Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
  3894. | [CVE-2004-0940] Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
  3895. | [CVE-2004-0885] The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
  3896. | [CVE-2004-0811] Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
  3897. | [CVE-2004-0809] The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
  3898. | [CVE-2004-0786] The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
  3899. | [CVE-2004-0751] The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).
  3900. | [CVE-2004-0748] mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
  3901. | [CVE-2004-0747] Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
  3902. | [CVE-2004-0700] Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
  3903. | [CVE-2004-0646] Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.
  3904. | [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
  3905. | [CVE-2004-0493] The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
  3906. | [CVE-2004-0492] Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
  3907. | [CVE-2004-0490] cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
  3908. | [CVE-2004-0488] Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
  3909. | [CVE-2004-0263] PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
  3910. | [CVE-2004-0174] Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
  3911. | [CVE-2004-0173] Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.
  3912. | [CVE-2004-0113] Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
  3913. | [CVE-2004-0009] Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.
  3914. | [CVE-2003-1581] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
  3915. | [CVE-2003-1580] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
  3916. | [CVE-2003-1573] The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
  3917. | [CVE-2003-1521] Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
  3918. | [CVE-2003-1516] The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
  3919. | [CVE-2003-1502] mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges.
  3920. | [CVE-2003-1418] Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child proccess IDs (PID).
  3921. | [CVE-2003-1307] ** DISPUTED **  The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port.  NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."
  3922. | [CVE-2003-1172] Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
  3923. | [CVE-2003-1171] Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
  3924. | [CVE-2003-1138] The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
  3925. | [CVE-2003-1054] mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
  3926. | [CVE-2003-0993] mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
  3927. | [CVE-2003-0987] mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
  3928. | [CVE-2003-0866] The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
  3929. | [CVE-2003-0844] mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
  3930. | [CVE-2003-0843] Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
  3931. | [CVE-2003-0789] mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
  3932. | [CVE-2003-0771] Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C, which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.
  3933. | [CVE-2003-0658] Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules.
  3934. | [CVE-2003-0542] Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
  3935. | [CVE-2003-0460] The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
  3936. | [CVE-2003-0254] Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.
  3937. | [CVE-2003-0253] The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.
  3938. | [CVE-2003-0249] ** DISPUTED **  PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive.  NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method.  A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods.  It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report."
  3939. | [CVE-2003-0245] Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.
  3940. | [CVE-2003-0192] Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.
  3941. | [CVE-2003-0189] The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.
  3942. | [CVE-2003-0134] Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
  3943. | [CVE-2003-0132] A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
  3944. | [CVE-2003-0083] Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
  3945. | [CVE-2003-0020] Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
  3946. | [CVE-2003-0017] Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
  3947. | [CVE-2003-0016] Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
  3948. | [CVE-2002-2310] ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows remote attackers to obtain usernames and passwords.
  3949. | [CVE-2002-2309] php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
  3950. | [CVE-2002-2272] Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
  3951. | [CVE-2002-2103] Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
  3952. | [CVE-2002-2029] PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
  3953. | [CVE-2002-2012] Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
  3954. | [CVE-2002-2009] Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
  3955. | [CVE-2002-2008] Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
  3956. | [CVE-2002-2007] The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
  3957. | [CVE-2002-2006] The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
  3958. | [CVE-2002-1895] The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
  3959. | [CVE-2002-1850] mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
  3960. | [CVE-2002-1793] HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request, which may allow attackers to cause a denial of service.
  3961. | [CVE-2002-1658] Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
  3962. | [CVE-2002-1635] The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
  3963. | [CVE-2002-1593] mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
  3964. | [CVE-2002-1592] The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
  3965. | [CVE-2002-1567] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
  3966. | [CVE-2002-1394] Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
  3967. | [CVE-2002-1233] A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
  3968. | [CVE-2002-1157] Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
  3969. | [CVE-2002-1156] Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
  3970. | [CVE-2002-1148] The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
  3971. | [CVE-2002-0935] Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
  3972. | [CVE-2002-0843] Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
  3973. | [CVE-2002-0840] Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
  3974. | [CVE-2002-0839] The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
  3975. | [CVE-2002-0682] Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
  3976. | [CVE-2002-0661] Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
  3977. | [CVE-2002-0658] OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
  3978. | [CVE-2002-0654] Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
  3979. | [CVE-2002-0653] Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
  3980. | [CVE-2002-0513] The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
  3981. | [CVE-2002-0493] Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
  3982. | [CVE-2002-0392] Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
  3983. | [CVE-2002-0259] InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache directory, or (2) mplog.txt, which could allow local users to gain privileges.
  3984. | [CVE-2002-0249] PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.
  3985. | [CVE-2002-0240] PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
  3986. | [CVE-2002-0082] The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
  3987. | [CVE-2002-0061] Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
  3988. | [CVE-2001-1556] The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
  3989. | [CVE-2001-1534] mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
  3990. | [CVE-2001-1510] Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
  3991. | [CVE-2001-1449] The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
  3992. | [CVE-2001-1385] The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
  3993. | [CVE-2001-1342] Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
  3994. | [CVE-2001-1217] Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
  3995. | [CVE-2001-1216] Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
  3996. | [CVE-2001-1072] Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
  3997. | [CVE-2001-1013] Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
  3998. | [CVE-2001-0925] The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
  3999. | [CVE-2001-0829] A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
  4000. | [CVE-2001-0766] Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
  4001. | [CVE-2001-0731] Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.
  4002. | [CVE-2001-0730] split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.
  4003. | [CVE-2001-0729] Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters.
  4004. | [CVE-2001-0590] Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
  4005. | [CVE-2001-0131] htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
  4006. | [CVE-2001-0108] PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
  4007. | [CVE-2001-0042] PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences.
  4008. | [CVE-2000-1247] The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.
  4009. | [CVE-2000-1210] Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
  4010. | [CVE-2000-1206] Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
  4011. | [CVE-2000-1205] Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code.  NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache.  The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
  4012. | [CVE-2000-1204] Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root.
  4013. | [CVE-2000-1168] IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.
  4014. | [CVE-2000-1016] The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.
  4015. | [CVE-2000-0913] mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.
  4016. | [CVE-2000-0883] The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory.
  4017. | [CVE-2000-0869] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary diretories via the PROPFIND HTTP request method.
  4018. | [CVE-2000-0868] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/.
  4019. | [CVE-2000-0791] Trustix installs the httpsd program for Apache-SSL with world-writeable permissions, which allows local users to replace it with a Trojan horse.
  4020. | [CVE-2000-0760] The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
  4021. | [CVE-2000-0759] Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
  4022. | [CVE-2000-0628] The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files.
  4023. | [CVE-2000-0505] The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
  4024. | [CVE-1999-1412] A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
  4025. | [CVE-1999-1293] mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
  4026. | [CVE-1999-1237] Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
  4027. | [CVE-1999-1199] Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.
  4028. | [CVE-1999-1053] guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
  4029. | [CVE-1999-0926] Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
  4030. | [CVE-1999-0678] A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.
  4031. | [CVE-1999-0448] IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.
  4032. | [CVE-1999-0289] The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL.
  4033. | [CVE-1999-0236] ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
  4034. | [CVE-1999-0107] Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
  4035. | [CVE-1999-0071] Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
  4036. |
  4037. | SecurityFocus - https://www.securityfocus.com/bid/:
  4038. | [104554] Apache HBase CVE-2018-8025 Security Bypass Vulnerability
  4039. | [104465] Apache Geode CVE-2017-15695 Remote Code Execution Vulnerability
  4040. | [104418] Apache Storm CVE-2018-8008 Arbitrary File Write Vulnerability
  4041. | [104399] Apache Storm CVE-2018-1332 User Impersonation Vulnerability
  4042. | [104348] Apache UIMA CVE-2017-15691 XML External Entity Injection Vulnerability
  4043. | [104313] Apache NiFi XML External Entity Injection and Denial of Service Vulnerability
  4044. | [104259] Apache Geode CVE-2017-12622 Authorization Bypass Vulnerability
  4045. | [104257] Apache Sling XSS Protection API CVE-2017-15717 Cross Site Scripting Vulnerability
  4046. | [104253] Apache ZooKeeper CVE-2018-8012 Security Bypass Vulnerability
  4047. | [104252] Apache Batik CVE-2018-8013 Information Disclosure Vulnerability
  4048. | [104239] Apache Solr CVE-2018-8010 XML External Entity Multiple Information Disclosure Vulnerabilities
  4049. | [104215] Apache ORC CVE-2018-8015 Denial of Service Vulnerability
  4050. | [104203] Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability
  4051. | [104161] Apache Ambari CVE-2018-8003 Directory Traversal Vulnerability
  4052. | [104140] Apache Derby CVE-2018-1313 Security Bypass Vulnerability
  4053. | [104135] Apache Tika CVE-2018-1338 Denial of Service Vulnerability
  4054. | [104008] Apache Fineract CVE-2018-1291 SQL Injection Vulnerability
  4055. | [104007] Apache Fineract CVE-2018-1292 SQL Injection Vulnerability
  4056. | [104005] Apache Fineract CVE-2018-1289 SQL Injection Vulnerability
  4057. | [104001] Apache Tika CVE-2018-1335 Remote Command Injection Vulnerability
  4058. | [103975] Apache Fineract CVE-2018-1290 SQL Injection Vulnerability
  4059. | [103974] Apache Solr CVE-2018-1308 XML External Entity Injection Vulnerability
  4060. | [103772] Apache Traffic Server CVE-2017-7671 Denial of Service Vulnerability
  4061. | [103770] Apache Traffic Server CVE-2017-5660 Security Bypass Vulnerability
  4062. | [103751] Apache Hive CVE-2018-1282 SQL Injection Vulnerability
  4063. | [103750] Apache Hive CVE-2018-1284 Security Bypass Vulnerability
  4064. | [103692] Apache Ignite CVE-2018-1295 Arbitrary Code Execution Vulnerability
  4065. | [103528] Apache HTTP Server CVE-2018-1302 Denial of Service Vulnerability
  4066. | [103525] Apache HTTP Server CVE-2017-15715 Remote Security Bypass Vulnerability
  4067. | [103524] Apache HTTP Server CVE-2018-1312 Remote Security Bypass Vulnerability
  4068. | [103522] Apache HTTP Server CVE-2018-1303 Denial of Service Vulnerability
  4069. | [103520] Apache HTTP Server CVE-2018-1283 Remote Security Vulnerability
  4070. | [103516] Apache Struts CVE-2018-1327 Denial of Service Vulnerability
  4071. | [103515] Apache HTTP Server CVE-2018-1301 Denial of Service Vulnerability
  4072. | [103512] Apache HTTP Server CVE-2017-15710 Denial of Service Vulnerability
  4073. | [103508] Apache Syncope CVE-2018-1321 Multiple Remote Code Execution Vulnerabilities
  4074. | [103507] Apache Syncope CVE-2018-1322 Multiple Information Disclosure Vulnerabilities
  4075. | [103490] Apache Commons Compress CVE-2018-1324 Multiple Denial Of Service Vulnerabilities
  4076. | [103434] APACHE Allura CVE-2018-1319 HTTP Response Splitting Vulnerability
  4077. | [103389] Apache Tomcat JK Connector CVE-2018-1323 Directory Traversal Vulnerability
  4078. | [103222] Apache CloudStack CVE-2013-4317 Information Disclosure Vulnerability
  4079. | [103219] Apache Xerces-C CVE-2017-12627 Null Pointer Dereference Denial of Service Vulnerability
  4080. | [103206] Apache Geode CVE-2017-15693 Remote Code Execution Vulnerability
  4081. | [103205] Apache Geode CVE-2017-15692 Remote Code Execution Vulnerability
  4082. | [103170] Apache Tomcat CVE-2018-1304 Security Bypass Vulnerability
  4083. | [103144] Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability
  4084. | [103102] Apache Oozie CVE-2017-15712 Information Disclosure Vulnerability
  4085. | [103098] Apache Karaf CVE-2016-8750 LDAP Injection Vulnerability
  4086. | [103069] Apache Tomcat CVE-2017-15706 Remote Security Weakness
  4087. | [103068] Apache JMeter CVE-2018-1287 Security Bypass Vulnerability
  4088. | [103067] Apache Qpid Dispatch Router 'router_core/connections.c' Denial of Service Vulnerability
  4089. | [103036] Apache CouchDB CVE-2017-12636 Remote Code Execution Vulnerability
  4090. | [103025] Apache Thrift CVE-2016-5397 Remote Command Injection Vulnerability
  4091. | [102879] Apache POI CVE-2017-12626 Multiple Denial of Service Vulnerabilities
  4092. | [102842] Apache NiFi CVE-2017-12632 Host Header Injection Vulnerability
  4093. | [102815] Apache NiFi CVE-2017-15697 Multiple Cross Site Scripting Vulnerabilities
  4094. | [102488] Apache Geode CVE-2017-9795 Remote Code Execution Vulnerability
  4095. | [102229] Apache Sling CVE-2017-15700 Information Disclosure Vulnerability
  4096. | [102226] Apache Drill CVE-2017-12630 Cross Site Scripting Vulnerability
  4097. | [102154] Multiple Apache  Products CVE-2017-15708 Remote Code Execution Vulnerability
  4098. | [102127] Apache CXF Fediz CVE-2017-12631 Multiple Cross Site Request Forgery Vulnerabilities
  4099. | [102041] Apache Qpid Broker-J CVE-2017-15701 Denial of Service Vulnerability
  4100. | [102040] Apache Qpid Broker CVE-2017-15702 Security Weakness
  4101. | [102021] Apache Struts CVE-2017-15707 Denial of Service Vulnerability
  4102. | [101980] EMC RSA Authentication Agent for Web: Apache Web Server Authentication Bypass Vulnerability
  4103. | [101876] Apache Camel CVE-2017-12634 Deserialization Remote Code Execution Vulnerability
  4104. | [101874] Apache Camel CVE-2017-12633 Deserialization Remote Code Execution Vulnerability
  4105. | [101872] Apache Karaf CVE-2014-0219 Local Denial of Service Vulnerability
  4106. | [101868] Apache CouchDB CVE-2017-12635 Remote Privilege Escalation Vulnerability
  4107. | [101859] Apache CXF CVE-2017-12624 Denial of Service Vulnerability
  4108. | [101844] Apache Sling Servlets Post CVE-2017-11296 Cross Site Scripting Vulnerability
  4109. | [101686] Apache Hive CVE-2017-12625 Information Disclosure Vulnerability
  4110. | [101644] Apache Wicket CVE-2012-5636 Cross Site Scripting Vulnerability
  4111. | [101631] Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities
  4112. | [101630] Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability
  4113. | [101625] Apache jUDDI CVE-2009-1197 Security Bypass Vulnerability
  4114. | [101623] Apache jUDDI CVE-2009-1198 Cross Site Scripting Vulnerability
  4115. | [101620] Apache Subversion 'libsvn_fs_fs/fs_fs.c' Denial of Service Vulnerability
  4116. | [101585] Apache OpenOffice Multiple Remote Code Execution Vulnerabilities
  4117. | [101577] Apache Wicket CVE-2016-6806 Cross Site Request Forgery Vulnerability
  4118. | [101575] Apache Wicket CVE-2014-0043 Information Disclosure Vulnerability
  4119. | [101570] Apache Geode CVE-2017-9797 Information Disclosure Vulnerability
  4120. | [101562] Apache Derby CVE-2010-2232 Arbitrary File Overwrite Vulnerability
  4121. | [101560] Apache Portable Runtime Utility CVE-2017-12613  Multiple Information Disclosure Vulnerabilities
  4122. | [101558] Apache Portable Runtime Utility Local Out-of-Bounds Read Denial of Service Vulnerability
  4123. | [101532] Apache James CVE-2017-12628 Arbitrary Command Execution Vulnerability
  4124. | [101516] Apache HTTP Server CVE-2017-12171 Security Bypass Vulnerability
  4125. | [101261] Apache Solr/Lucene CVE-2017-12629 Information Disclosure and Remote Code Execution Vulnerabilities
  4126. | [101230] Apache Roller CVE-2014-0030 XML External Entity Injection Vulnerability
  4127. | [101173] Apache IMPALA CVE-2017-9792 Information Disclosure Vulnerability
  4128. | [101052] Apache Commons Jelly CVE-2017-12621 Security Bypass Vulnerability
  4129. | [101027] Apache Mesos CVE-2017-7687 Denial of Service Vulnerability
  4130. | [101023] Apache Mesos CVE-2017-9790 Denial of Service Vulnerability
  4131. | [100954] Apache Tomcat CVE-2017-12617 Incomplete Fix Remote Code Execution Vulnerability
  4132. | [100946] Apache Wicket CVE-2014-7808 Cross Site Request Forgery Vulnerability
  4133. | [100901] Apache Tomcat CVE-2017-12615 Remote Code Execution Vulnerability
  4134. | [100897] Apache Tomcat CVE-2017-12616 Information Disclosure Vulnerability
  4135. | [100880] Apache Directory LDAP API CVE-2015-3250 Unspecified Information Disclosure Vulnerability
  4136. | [100872] Apache HTTP Server CVE-2017-9798 Information Disclosure Vulnerability
  4137. | [100870] Apache Solr CVE-2017-9803 Remote Privilege Escalation Vulnerability
  4138. | [100859] puppetlabs-apache CVE-2017-2299 Information Disclosure Vulnerability
  4139. | [100829] Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability
  4140. | [100823] Apache Spark CVE-2017-12612 Deserialization Remote Code Execution Vulnerability
  4141. | [100612] Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability
  4142. | [100611] Apache Struts CVE-2017-9793 Denial of Service Vulnerability
  4143. | [100609] Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability
  4144. | [100587] Apache Atlas CVE-2017-3155 Cross Frame Scripting Vulnerability
  4145. | [100581] Apache Atlas CVE-2017-3154 Information Disclosure Vulnerability
  4146. | [100578] Apache Atlas CVE-2017-3153 Cross Site Scripting Vulnerability
  4147. | [100577] Apache Atlas CVE-2017-3152 Cross Site Scripting Vulnerability
  4148. | [100547] Apache Atlas CVE-2017-3151 HTML Injection Vulnerability
  4149. | [100536] Apache Atlas CVE-2017-3150 Cross Site Scripting Vulnerability
  4150. | [100449] Apache Pony Mail CVE-2016-4460 Authentication Bypass Vulnerability
  4151. | [100447] Apache2Triad Multiple Security Vulnerabilities
  4152. | [100284] Apache Sling Servlets Post CVE-2017-9802 Cross Site Scripting Vulnerability
  4153. | [100280] Apache Tomcat CVE-2017-7674 Security Bypass Vulnerability
  4154. | [100259] Apache Subversion CVE-2017-9800 Remote Command Execution Vulnerability
  4155. | [100256] Apache Tomcat CVE-2017-7675 Directory Traversal Vulnerability
  4156. | [100235] Apache Storm CVE-2017-9799 Remote Code Execution Vulnerability
  4157. | [100082] Apache Commons Email CVE-2017-9801 SMTP Header Injection Vulnerability
  4158. | [99873] Apache Sling XSS Protection API CVE-2016-6798 XML External Entity Injection Vulnerability
  4159. | [99870] Apache Sling API CVE-2016-5394 Cross Site Scripting Vulnerability
  4160. | [99603] Apache Spark CVE-2017-7678 Cross Site Scripting Vulnerability
  4161. | [99592] Apache OpenMeetings CVE-2017-7685 Security Bypass Vulnerability
  4162. | [99587] Apache OpenMeetings CVE-2017-7673 Security Bypass Vulnerability
  4163. | [99586] Apache OpenMeetings CVE-2017-7688 Security Bypass Vulnerability
  4164. | [99584] Apache OpenMeetings CVE-2017-7684 Denial of Service Vulnerability
  4165. | [99577] Apache OpenMeetings CVE-2017-7663 Cross Site Scripting Vulnerability
  4166. | [99576] Apache OpenMeetings CVE-2017-7664 XML External Entity Injection Vulnerability
  4167. | [99569] Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability
  4168. | [99568] Apache HTTP Server CVE-2017-9789 Denial of Service Vulnerability
  4169. | [99563] Apache Struts CVE-2017-7672 Denial of Service Vulnerability
  4170. | [99562] Apache Struts Spring AOP Functionality Denial of Service Vulnerability
  4171. | [99509] Apache Impala CVE-2017-5652 Information Disclosure Vulnerability
  4172. | [99508] Apache IMPALA CVE-2017-5640 Authentication Bypass Vulnerability
  4173. | [99486] Apache Traffic Control CVE-2017-7670 Denial of Service Vulnerability
  4174. | [99485] Apache Solr CVE-2017-7660 Security Bypass Vulnerability
  4175. | [99484] Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability
  4176. | [99292] Apache Ignite CVE-2017-7686 Information Disclosure Vulnerability
  4177. | [99170] Apache HTTP Server CVE-2017-7679 Buffer Overflow Vulnerability
  4178. | [99137] Apache HTTP Server CVE-2017-7668 Denial of Service Vulnerability
  4179. | [99135] Apache HTTP Server CVE-2017-3167 Authentication Bypass Vulnerability
  4180. | [99134] Apache HTTP Server CVE-2017-3169 Denial of Service Vulnerability
  4181. | [99132] Apache HTTP Server CVE-2017-7659 Denial of Service Vulnerability
  4182. | [99112] Apache Thrift CVE-2015-3254 Denial of Service Vulnerability
  4183. | [99067] Apache Ranger CVE-2016-8751 HTML Injection Vulnerability
  4184. | [99018] Apache NiFi CVE-2017-7667 Cross Frame Scripting Vulnerability
  4185. | [99009] Apache NiFi CVE-2017-7665 Cross Site Scripting Vulnerability
  4186. | [98961] Apache Ranger CVE-2017-7677 Security Bypass Vulnerability
  4187. | [98958] Apache Ranger CVE-2017-7676 Security Bypass Vulnerability
  4188. | [98888] Apache Tomcat CVE-2017-5664 Security Bypass Vulnerability
  4189. | [98814] Apache Zookeeper CVE-2017-5637 Denial of Service Vulnerability
  4190. | [98795] Apache Hadoop CVE-2017-7669 Remote Privilege Escalation Vulnerability
  4191. | [98739] Apache Knox CVE-2017-5646 User Impersonation Vulnerability
  4192. | [98669] Apache Hive CVE-2016-3083 Security Bypass Vulnerability
  4193. | [98646] Apache Atlas CVE-2016-8752 Information Disclosure Vulnerability
  4194. | [98570] Apache Archiva CVE-2017-5657 Multiple Cross-Site Request Forgery Vulnerabilities
  4195. | [98489] Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities
  4196. | [98485] Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability
  4197. | [98466] Apache Ambari CVE-2017-5655 Insecure Temporary File Handling Vulnerability
  4198. | [98365] Apache Cordova For Android CVE-2016-6799 Information Disclosure Vulnerability
  4199. | [98025] Apache Hadoop CVE-2017-3161 Cross Site Scripting Vulnerability
  4200. | [98017] Apache Hadoop CVE-2017-3162 Input Validation Vulnerability
  4201. | [97971] Apache CXF CVE-2017-5656 Information Disclosure Vulnerability
  4202. | [97968] Apache CXF CVE-2017-5653 Spoofing Vulnerability
  4203. | [97967] Apache ActiveMQ CVE-2015-7559 Denial of Service Vulnerability
  4204. | [97949] Apache Traffic Server CVE-2017-5659 Denial of Service Vulnerability
  4205. | [97948] Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability
  4206. | [97947] Apache FOP CVE-2017-5661 XML External Entity Information Disclosure Vulnerability
  4207. | [97945] Apache Traffic Server CVE-2016-5396 Denial of Service Vulnerability
  4208. | [97702] Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
  4209. | [97582] Apache CXF CVE-2016-6812 Cross Site Scripting Vulnerability
  4210. | [97579] Apache CXF JAX-RS CVE-2016-8739 XML External Entity Injection Vulnerability
  4211. | [97544] Apache Tomcat CVE-2017-5651 Information Disclosure Vulnerability
  4212. | [97531] Apache Tomcat CVE-2017-5650 Denial of Service Vulnerability
  4213. | [97530] Apache Tomcat CVE-2017-5648  Information Disclosure Vulnerability
  4214. | [97509] Apache Ignite CVE-2016-6805 Information Disclosure and XML External Entity Injection Vulnerabilities
  4215. | [97383] Apache Flex BlazeDS CVE-2017-5641 Remote Code Execution Vulnerability
  4216. | [97378] Apache Geode CVE-2017-5649 Information Disclosure Vulnerability
  4217. | [97229] Apache Ambari CVE-2016-4976 Local Information Disclosure Vulnerability
  4218. | [97226] Apache Camel CVE-2017-5643 Server Side Request Forgery Security Bypass Vulnerability
  4219. | [97184] Apache Ambari CVE-2016-6807 Remote Command Execution Vulnerability
  4220. | [97179] Apache Camel CVE-2016-8749 Java Deserialization Multiple Remote Code Execution Vulnerabilities
  4221. | [96983] Apache POI CVE-2017-5644 Denial Of Service Vulnerability
  4222. | [96895] Apache Tomcat CVE-2016-8747  Information Disclosure Vulnerability
  4223. | [96731] Apache NiFi CVE-2017-5636 Remote Code Injection Vulnerability
  4224. | [96730] Apache NiFi CVE-2017-5635 Security Bypass Vulnerability
  4225. | [96729] Apache Struts CVE-2017-5638 Remote Code Execution Vulnerability
  4226. | [96540] IBM Development Package for Apache Spark CVE-2016-4970 Denial of Service Vulnerability
  4227. | [96398] Apache CXF CVE-2017-3156 Information Disclosure Vulnerability
  4228. | [96321] Apache Camel CVE-2017-3159 Remote Code Execution Vulnerability
  4229. | [96293] Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability
  4230. | [96228] Apache Brooklyn Cross Site Request Forgery and Multiple Cross Site Scripting Vulnerabilities
  4231. | [95998] Apache Ranger CVE-2016-8746 Security Bypass Vulnerability
  4232. | [95929] Apache Groovy CVE-2016-6497 Information Disclosure Vulnerability
  4233. | [95838] Apache Cordova For Android CVE-2017-3160 Man in the Middle Security Bypass Vulnerability
  4234. | [95675] Apache Struts Remote Code Execution Vulnerability
  4235. | [95621] Apache NiFi CVE-2106-8748 Cross Site Scripting Vulnerability
  4236. | [95429] Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability
  4237. | [95335] Apache Hadoop CVE-2016-3086 Information Disclosure Vulnerability
  4238. | [95168] Apache Wicket CVE-2016-6793 Denial of Service Vulnerability
  4239. | [95136] Apache Qpid Broker for Java CVE-2016-8741 Remote Information Disclosure Vulnerability
  4240. | [95078] Apache HTTP Server CVE-2016-0736 Remote Security Vulnerability
  4241. | [95077] Apache HTTP Server CVE-2016-8743 Security Bypass Vulnerability
  4242. | [95076] Apache HTTP Server CVE-2016-2161 Denial of Service Vulnerability
  4243. | [95020] Apache Tika CVE-2015-3271 Remote Information Disclosure Vulnerability
  4244. | [94950] Apache Hadoop CVE-2016-5001 Local Information Disclosure Vulnerability
  4245. | [94882] Apache ActiveMQ CVE-2016-6810 HTML Injection Vulnerability
  4246. | [94828] Apache Tomcat CVE-2016-8745  Information Disclosure Vulnerability
  4247. | [94766] Apache CouchDB CVE-2016-8742 Local Privilege Escalation Vulnerability
  4248. | [94657] Apache Struts CVE-2016-8738 Denial of Service Vulnerability
  4249. | [94650] Apache HTTP Server CVE-2016-8740 Denial of Service Vulnerability
  4250. | [94588] Apache Subversion CVE-2016-8734 XML External Entity Denial of Service Vulnerability
  4251. | [94513] Apache Karaf CVE-2016-8648 Remote Code Execution Vulnerability
  4252. | [94463] Apache Tomcat CVE-2016-8735 Remote Code Execution Vulnerability
  4253. | [94462] Apache Tomcat CVE-2016-6817 Denial of Service Vulnerability
  4254. | [94461] Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability
  4255. | [94418] Apache OpenOffice CVE-2016-6803 Local Privilege Escalation Vulnerability
  4256. | [94247] Apache Tika CVE-2016-6809 Remote Code Execution Vulnerability
  4257. | [94221] Apache Ranger CVE-2016-6815 Local Privilege Escalation Vulnerability
  4258. | [94145] Apache OpenMeetings CVE-2016-8736 Remote Code Execution Vulnerability
  4259. | [93945] Apache CloudStack CVE-2016-6813 Authorization Bypass Vulnerability
  4260. | [93944] Apache Tomcat Security Manager CVE-2016-6796 Security Bypass Vulnerability
  4261. | [93943] Apache Tomcat CVE-2016-6794 Security Bypass Vulnerability
  4262. | [93942] Apache Tomcat Security Manager CVE-2016-5018 Security Bypass Vulnerability
  4263. | [93940] Apache Tomcat CVE-2016-6797 Security Bypass Vulnerability
  4264. | [93939] Apache Tomcat CVE-2016-0762 Information Disclosure Vulnerability
  4265. | [93774] Apache OpenOffice CVE-2016-6804 DLL Loading Remote Code Execution Vulnerability
  4266. | [93773] Apache Struts CVE-2016-6795 Directory Traversal Vulnerability
  4267. | [93478] Apache Tomcat CVE-2016-6325 Local Privilege Escalation Vulnerability
  4268. | [93472] Apache Tomcat CVE-2016-5425 Insecure File Permissions Vulnerability
  4269. | [93429] Apache Tomcat JK Connector CVE-2016-6808 Remote Buffer Overflow Vulnerability
  4270. | [93263] Apache Tomcat CVE-2016-1240 Local Privilege Escalation Vulnerability
  4271. | [93236] Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability
  4272. | [93142] Apache ActiveMQ Artemis CVE-2016-4978 Remote Code Execution Vulnerability
  4273. | [93132] Apache Derby CVE-2015-1832 XML External Entity Information Disclosure Vulnerability
  4274. | [93044] Apache Zookeeper CVE-2016-5017 Buffer Overflow Vulnerability
  4275. | [92966] Apache Jackrabbit CVE-2016-6801 Cross-Site Request Forgery Vulnerability
  4276. | [92947] Apache Shiro CVE-2016-6802 Remote Security Bypass Vulnerability
  4277. | [92905] Apache CXF Fediz CVE-2016-4464 Security Bypass Vulnerability
  4278. | [92577] Apache Ranger CVE-2016-5395 HTML Injection Vulnerability
  4279. | [92331] Apache HTTP Server CVE-2016-1546 Remote Denial of Service Vulnerability
  4280. | [92328] Apache Hive CVE-2016-0760 Multiple Remote Code Execution Vulnerabilities
  4281. | [92320] Apache APR-util and httpd CVE-2016-6312 Denial of Service Vulnerability
  4282. | [92100] Apache POI CVE-2016-5000 XML External Entity Injection Vulnerability
  4283. | [92079] Apache OpenOffice CVE-2016-1513 Remote Code Execution Vulnerability
  4284. | [91818] Apache Tomcat CVE-2016-5388 Security Bypass Vulnerability
  4285. | [91816] Apache HTTP Server CVE-2016-5387 Security Bypass Vulnerability
  4286. | [91788] Apache Qpid Proton CVE-2016-4467 Certificate Verification Security Bypass Vulnerability
  4287. | [91738] Apache XML-RPC CVE-2016-5003 Remote Code Execution Vulnerability
  4288. | [91736] Apache XML-RPC Multiple Security Vulnerabilities
  4289. | [91707] Apache Archiva CVE-2016-5005 HTML Injection Vulnerability
  4290. | [91703] Apache Archiva CVE-2016-4469 Multiple Cross-Site Request Forgery Vulnerabilities
  4291. | [91566] Apache HTTP Server CVE-2016-4979 Authentication Bypass Vulnerability
  4292. | [91537] Apache QPID CVE-2016-4974 Deserialization Security Bypass Vulnerability
  4293. | [91501] Apache Xerces-C CVE-2016-4463 Stack Buffer Overflow Vulnerability
  4294. | [91453] Apache Commons FileUpload CVE-2016-3092 Denial Of Service Vulnerability
  4295. | [91284] Apache Struts CVE-2016-4431 Security Bypass Vulnerability
  4296. | [91282] Apache Struts CVE-2016-4433 Security Bypass Vulnerability
  4297. | [91281] Apache Struts CVE-2016-4430 Cross-Site Request Forgery Vulnerability
  4298. | [91280] Apache Struts CVE-2016-4436 Security Bypass Vulnerability
  4299. | [91278] Apache Struts CVE-2016-4465 Denial of Service Vulnerability
  4300. | [91277] Apache Struts Incomplete Fix Remote Code Execution Vulnerability
  4301. | [91275] Apache Struts CVE-2016-4438 Remote Code Execution Vulnerability
  4302. | [91217] Apache Continuum 'saveInstallation.action' Command Execution Vulnerability
  4303. | [91141] Apache CloudStack CVE-2016-3085 Authentication Bypass Vulnerability
  4304. | [91068] Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
  4305. | [91067] Apache Struts CVE-2016-1182 Security Bypass Vulnerability
  4306. | [91024] Apache Shiro CVE-2016-4437 Information Disclosure Vulnerability
  4307. | [90988] Apache Ranger CVE-2016-2174 SQL Injection Vulnerability
  4308. | [90961] Apache Struts CVE-2016-3093 Denial of Service Vulnerability
  4309. | [90960] Apache Struts CVE-2016-3087 Remote Code Execution Vulnerability
  4310. | [90921] Apache Qpid CVE-2016-4432 Authentication Bypass Vulnerability
  4311. | [90920] Apache Qpid CVE-2016-3094 Denial of Service Vulnerability
  4312. | [90902] Apache PDFBox CVE-2016-2175 XML External Entity Injection Vulnerability
  4313. | [90897] Apache Tika CVE-2016-4434 XML External Entity Injection Vulnerability
  4314. | [90827] Apache ActiveMQ CVE-2016-3088 Multiple Arbitrary File Upload Vulnerabilities
  4315. | [90755] Apache Ambari CVE-2016-0707 Multiple Local Information Disclosure Vulnerabilities
  4316. | [90482] Apache CVE-2004-1387 Local Security Vulnerability
  4317. | [89762] Apache CVE-2001-1556 Remote Security Vulnerability
  4318. | [89417] Apache Subversion CVE-2016-2167 Authentication Bypass Vulnerability
  4319. | [89326] RETIRED: Apache Subversion CVE-2016-2167 Security Bypass Vulnerability
  4320. | [89320] Apache Subversion CVE-2016-2168 Remote Denial of Service Vulnerability
  4321. | [88826] Apache Struts CVE-2016-3082 Remote Code Execution Vulnerability
  4322. | [88797] Apache Cordova For iOS CVE-2015-5208 Arbitrary Code Execution Vulnerability
  4323. | [88764] Apache Cordova iOS CVE-2015-5207 Multiple Security Bypass Vulnerabilities
  4324. | [88701] Apache CVE-2001-1449 Remote Security Vulnerability
  4325. | [88635] Apache CVE-2000-1204 Remote Security Vulnerability
  4326. | [88590] Apache WWW server CVE-1999-1199 Denial-Of-Service Vulnerability
  4327. | [88496] Apache CVE-2000-1206 Remote Security Vulnerability
  4328. | [87828] Apache CVE-1999-1237 Remote Security Vulnerability
  4329. | [87784] Apache CVE-1999-1293 Denial-Of-Service Vulnerability
  4330. | [87327] Apache Struts CVE-2016-3081 Remote Code Execution Vulnerability
  4331. | [86622] Apache Stats CVE-2007-0975 Remote Security Vulnerability
  4332. | [86399] Apache CVE-2007-1743 Local Security Vulnerability
  4333. | [86397] Apache CVE-2007-1742 Local Security Vulnerability
  4334. | [86311] Apache Struts CVE-2016-4003 Cross Site Scripting Vulnerability
  4335. | [86174] Apache Wicket CVE-2015-5347 Cross Site Scripting Vulnerability
  4336. | [85971] Apache OFBiz CVE-2016-2170 Java Deserialization Remote Code Execution Vulnerability
  4337. | [85967] Apache OFBiz CVE-2015-3268 HTML Injection Vulnerability
  4338. | [85759] Apache Jetspeed CVE-2016-2171 Unauthorized Access Vulnerability
  4339. | [85758] Apache Jetspeed CVE-2016-0712 Cross Site Scripting Vulnerability
  4340. | [85756] Apache Jetspeed CVE-2016-0710 Multiple SQL Injection Vulnerabilities
  4341. | [85755] Apache Jetspeed CVE-2016-0711 Mulitple HTML Injection Vulnerabilities
  4342. | [85754] Apache Jetspeed CVE-2016-0709 Directory Traversal Vulnerability
  4343. | [85730] Apache Subversion CVE-2015-5343 Integer Overflow Vulnerability
  4344. | [85691] Apache Ranger CVE-2016-0735 Security Bypass Vulnerability
  4345. | [85578] Apache ActiveMQ CVE-2010-1244 Cross-Site Request Forgery Vulnerability
  4346. | [85554] Apache OpenMeetings CVE-2016-2164 Multiple Information Disclosure Vulnerabilities
  4347. | [85553] Apache OpenMeetings CVE-2016-0783 Information Disclosure Vulnerability
  4348. | [85552] Apache OpenMeetings CVE-2016-2163 HTML Injection Vulnerability
  4349. | [85550] Apache OpenMeetings CVE-2016-0784 Directory Traversal Vulnerability
  4350. | [85386] Apache Hadoop CVE-2015-7430 Local Privilege Escalation Vulnerability
  4351. | [85377] Apache Qpid Proton Python API CVE-2016-2166 Man in the Middle Security Bypass Vulnerability
  4352. | [85205] Apache Solr CVE-2015-8796 Cross Site Scripting Vulnerability
  4353. | [85203] Apache Solr CVE-2015-8795 Mulitple HTML Injection Vulnerabilities
  4354. | [85163] Apache Geronimo CVE-2008-0732 Local Security Vulnerability
  4355. | [85131] Apache Struts 'TextParseUtil.translateVariables()' Method Remote Code Execution Vulnerability
  4356. | [85070] Apache Struts CVE-2016-2162 Cross Site Scripting Vulnerability
  4357. | [85066] Apache Struts CVE-2016-0785 Remote Code Execution Vulnerability
  4358. | [84422] Apache TomEE CVE-2016-0779 Unspecified Security Vulnerability
  4359. | [84321] Apache ActiveMQ CVE-2016-0734 Clickjacking Vulnerability
  4360. | [84316] Apache ActiveMQ  CVE-2016-0782 Multiple Cross Site Scripting Vulnerabilities
  4361. | [83910] Apache Wicket CVE-2015-7520 Cross Site Scripting Vulnerability
  4362. | [83423] Apache Xerces-C CVE-2016-0729 Buffer Overflow Vulnerability
  4363. | [83330] Apache Tomcat CVE-2015-5351 Cross Site Request Forgery Vulnerability
  4364. | [83329] Apache Tomcat CVE-2015-5174 Directory Traversal Vulnerability
  4365. | [83328] Apache Tomcat CVE-2015-5345 Directory Traversal Vulnerability
  4366. | [83327] Apache Tomcat Security Manager CVE-2016-0714 Remote Code Execution Vulnerability
  4367. | [83326] Apache Tomcat CVE-2016-0763 Security Bypass Vulnerability
  4368. | [83324] Apache Tomcat Security Manager CVE-2016-0706 Information Disclosure Vulnerability
  4369. | [83323] Apache Tomcat CVE-2015-5346 Session Fixation Vulnerability
  4370. | [83259] Apache Hadoop CVE-2015-1776 Information Disclosure Vulnerability
  4371. | [83243] Apache Solr CVE-2015-8797 Cross Site Scripting Vulnerability
  4372. | [83119] Apache Sling CVE-2016-0956 Information Disclosure Vulnerability
  4373. | [83002] Apache CVE-2000-1205 Cross-Site Scripting Vulnerability
  4374. | [82871] Apache Ranger Authentication Bypass and Security Bypass Vulnerabilities
  4375. | [82800] Apache CloudStack CVE-2015-3251 Information Disclosure Vulnerability
  4376. | [82798] Apache CloudStack CVE-2015-3252 Authentication Bypass Vulnerability
  4377. | [82732] Apache Gallery CVE-2003-0771 Local Security Vulnerability
  4378. | [82676] Apache CVE-2003-1581 Cross-Site Scripting Vulnerability
  4379. | [82550] Apache Struts CVE-2015-5209 Security Bypass Vulnerability
  4380. | [82300] Apache Subversion CVE-2015-5259 Integer Overflow Vulnerability
  4381. | [82260] Apache Camel CVE-2015-5344 Remote Code Execution Vulnerability
  4382. | [82234] Apache Hive CVE-2015-7521 Security Bypass Vulnerability
  4383. | [82082] Apache CVE-1999-0289 Remote Security Vulnerability
  4384. | [81821] Apache Distribution for Solaris CVE-2007-2080 SQL-Injection Vulnerability
  4385. | [80696] Apache Camel CVE-2015-5348 Information Disclosure Vulnerability
  4386. | [80525] Apache CVE-2003-1580 Remote Security Vulnerability
  4387. | [80354] Drupal Apache Solr Search Module Access Bypass Vulnerability
  4388. | [80193] Apache CVE-1999-0107 Denial-Of-Service Vulnerability
  4389. | [79812] Apache Directory Studio CVE-2015-5349 Command Injection Vulnerability
  4390. | [79744] Apache HBase CVE-2015-1836 Unauthorized Access Vulnerability
  4391. | [79204] Apache TomEE 'EjbObjectInputStream' Remote Code Execution Vulnerability
  4392. | [77679] Apache Cordova For Android CVE-2015-8320 Weak Randomization Security Bypass Vulnerability
  4393. | [77677] Apache Cordova For Android CVE-2015-5256 Security Bypass Vulnerability
  4394. | [77591] Apache CXF SAML SSO Processing CVE-2015-5253 Security Bypass Vulnerability
  4395. | [77521] Apache Commons Collections 'InvokerTransformer.java' Remote Code Execution Vulnerability
  4396. | [77110] Apache HttpComponents HttpClient CVE-2015-5262 Denial of Service Vulnerability
  4397. | [77086] Apache Ambari CVE-2015-1775 Server Side Request Forgery Security Bypass Vulnerability
  4398. | [77085] Apache Ambari CVE-2015-3270 Remote Privilege Escalation Vulnerability
  4399. | [77082] Apache Ambari 'targetURI' Parameter Open Redirection Vulnerability
  4400. | [77059] Apache Ambari CVE-2015-3186 Cross Site Scripting Vulnerability
  4401. | [76933] Apache James Server Unspecified Command Execution Vulnerability
  4402. | [76832] Apache cordova-plugin-file-transfer CVE-2015-5204 HTTP Header Injection Vulnerability
  4403. | [76625] Apache Struts CVE-2015-5169 Cross Site Scripting Vulnerability
  4404. | [76624] Apache Struts CVE-2015-2992 Cross Site Scripting Vulnerability
  4405. | [76522] Apache Tapestry CVE-2014-1972 Security Bypass Vulnerability
  4406. | [76486] Apache CXF Fediz CVE-2015-5175 Denial of Service Vulnerability
  4407. | [76452] Apache ActiveMQ CVE-2015-1830 Directory Traversal Vulnerability
  4408. | [76446] Apache Subversion 'libsvn_fs_fs/tree.c' Denial of Service Vulnerability
  4409. | [76274] Apache Subversion CVE-2015-3184 Information Disclosure Vulnerability
  4410. | [76273] Apache Subversion CVE-2015-3187 Information Disclosure Vulnerability
  4411. | [76272] Apache ActiveMQ CVE-2014-3576 Denial of Service Vulnerability
  4412. | [76221] Apache Ranger CVE-2015-0266 Access Bypass Vulnerability
  4413. | [76208] Apache Ranger CVE-2015-0265 JavaScript Code Injection Vulnerability
  4414. | [76025] Apache ActiveMQ Artemis CVE-2015-3208 XML External Entity Information Disclosure Vulnerability
  4415. | [75965] Apache HTTP Server CVE-2015-3185 Security Bypass Vulnerability
  4416. | [75964] Apache HTTP Server CVE-2015-0253 Remote Denial of Service Vulnerability
  4417. | [75963] Apache HTTP Server CVE-2015-3183 Security Vulnerability
  4418. | [75940] Apache Struts CVE-2015-1831 Security Bypass Vulnerability
  4419. | [75919] Apache Groovy CVE-2015-3253 Remote Code Execution Vulnerability
  4420. | [75338] Apache Storm CVE-2015-3188 Remote Code Execution Vulnerability
  4421. | [75275] Drupal Apache Solr Real-Time Module Access Bypass Vulnerability
  4422. | [74866] Apache Cordova For Android CVE-2015-1835 Security Bypass Vulnerability
  4423. | [74839] Apache Sling API and Sling Servlets CVE-2015-2944 Cross Site Scripting Vulnerability
  4424. | [74761] Apache Jackrabbit CVE-2015-1833 XML External Entity Information Disclosure Vulnerability
  4425. | [74686] Apache Ambari '/var/lib/ambari-server/ambari-env.sh' Local Privilege Escalation Vulnerability
  4426. | [74665] Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability
  4427. | [74475] Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability
  4428. | [74423] Apache Struts CVE-2015-0899 Security Bypass Vulnerability
  4429. | [74338] Apache OpenOffice HWP Filter Memory Corruption Vulnerability
  4430. | [74265] Apache Tomcat 'mod_jk' CVE-2014-8111 Information Disclosure Vulnerability
  4431. | [74260] Apache Subversion CVE-2015-0248 Multiple Denial of Service Vulnerabilities
  4432. | [74259] Apache Subversion 'deadprops.c' Security Bypass Vulnerability
  4433. | [74204] PHP 'sapi/apache2handler/sapi_apache2.c' Remote Code Execution Vulnerability
  4434. | [74158] Apache HTTP Server 'protocol.c' Remote Denial of Service Vulnerability
  4435. | [73954] Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability
  4436. | [73851] Apache2 CVE-2012-0216 Cross-Site Scripting Vulnerability
  4437. | [73478] Apache Cassandra CVE-2015-0225 Remote Code Execution Vulnerability
  4438. | [73041] Apache HTTP Server 'mod_lua' Module Denial of Service Vulnerability
  4439. | [73040] Apache HTTP Server 'mod_lua.c' Local Access Bypass Vulnerability
  4440. | [72809] Apache Standard Taglibs CVE-2015-0254 XML External Entity Injection Vulnerability
  4441. | [72717] Apache Tomcat CVE-2014-0227 Chunk Request Remote Denial Of Service Vulnerability
  4442. | [72557] Apache WSS4J CVE-2015-0227 Security Bypass Vulnerability
  4443. | [72553] Apache WSS4J CVE-2015-0226 Information Disclosure Vulnerability
  4444. | [72513] Apache ActiveMQ CVE-2014-3612 LDAP Authentication Bypass Vulnerability
  4445. | [72511] Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities
  4446. | [72510] Apache ActiveMQ CVE-2014-3600 XML External Entity Injection Vulnerability
  4447. | [72508] Apache ActiveMQ Apollo CVE-2014-3579 XML External Entity Injection Vulnerability
  4448. | [72319] Apache Qpid CVE-2015-0223 Security Bypass Vulnerability
  4449. | [72317] Apache Qpid CVE-2015-0224 Incomplete Fix Multiple Denial of Service Vulnerabilities
  4450. | [72115] Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability
  4451. | [72053] Apache HTTP Server 'mod_remoteip.c' IP Address Spoofing Vulnerability
  4452. | [72030] Apache Qpid CVE-2015-0203 Multiple Denial of Service Vulnerabilities
  4453. | [71879] Apache Traffic Server 'HttpTransact.cc' Denial of Service Vulnerability
  4454. | [71726] Apache Subversion CVE-2014-3580 Remote Denial of Service Vulnerability
  4455. | [71725] Apache Subversion CVE-2014-8108 Remote Denial of Service Vulnerability
  4456. | [71657] Apache HTTP Server 'mod_proxy_fcgi' Module Denial of Service Vulnerability
  4457. | [71656] Apache HTTP Server 'mod_cache' Module Denial of Service Vulnerability
  4458. | [71548] Apache Struts CVE-2014-7809 Security Bypass Vulnerability
  4459. | [71466] Apache Hadoop CVE-2014-3627 Information Disclosure Vulnerability
  4460. | [71353] Apache HTTP Server 'LuaAuthzProvider' Authorization Bypass Vulnerability
  4461. | [71004] Apache Qpid CVE-2014-3629 XML External Entity Injection Vulnerability
  4462. | [70970] Apache Traffic Server Cross Site Scripting Vulnerability
  4463. | [70738] Apache CXF CVE-2014-3584 Denial of Service Vulnerability
  4464. | [70736] Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
  4465. | [69728] Apache Tomcat CVE-2013-4444 Arbitrary File Upload Vulnerability
  4466. | [69648] Apache POI CVE-2014-3574 Denial Of Service Vulnerability
  4467. | [69647] Apache POI OpenXML parser CVE-2014-3529 XML External Entity Information Disclosure Vulnerability
  4468. | [69351] Apache OpenOffice Calc CVE-2014-3524 Command Injection Vulnerability
  4469. | [69295] Apache Axis Incomplete Fix CVE-2014-3596 SSL Certificate Validation Security Bypass Vulnerability
  4470. | [69286] Apache OFBiz CVE-2014-0232 Multiple Cross Site Scripting Vulnerabilities
  4471. | [69258] Apache HttpComponents Incomplete Fix CVE-2014-3577 SSL Validation Security Bypass Vulnerability
  4472. | [69257] Apache HttpComponents Incomplete Fix SSL Certificate Validation Security Bypass Vulnerability
  4473. | [69248] Apache HTTP Server CVE-2013-4352 Remote Denial of Service Vulnerability
  4474. | [69237] Apache Subversion CVE-2014-3522 SSL Certificate Validation Information Disclosure Vulnerability
  4475. | [69173] Apache Traffic Server CVE-2014-3525 Unspecified Security Vulnerability
  4476. | [69046] Apache Cordova For Android CVE-2014-3502 Information Disclosure Vulnerability
  4477. | [69041] Apache Cordova For Android CVE-2014-3501 Security Bypass Vulnerability
  4478. | [69038] Apache Cordova For Android CVE-2014-3500 Security Bypass Vulnerability
  4479. | [68995] Apache Subversion CVE-2014-3528 Insecure Authentication Weakness
  4480. | [68966] Apache Subversion 'irkerbridge.py' Local Privilege Escalation Vulnerability
  4481. | [68965] Apache Subversion 'svnwcsub.py' Local Privilege Escalation Vulnerability
  4482. | [68863] Apache HTTP Server 'mod_cache' Module Remote Denial of Service Vulnerability
  4483. | [68747] Apache HTTP Server CVE-2014-3523 Remote Denial of Service Vulnerability
  4484. | [68745] Apache HTTP Server CVE-2014-0118 Remote Denial of Service Vulnerability
  4485. | [68742] Apache HTTP Server CVE-2014-0231 Remote Denial of Service Vulnerability
  4486. | [68740] Apache HTTP Server CVE-2014-0117 Remote Denial of Service Vulnerability
  4487. | [68678] Apache HTTP Server 'mod_status' CVE-2014-0226 Remote Code Execution Vulnerability
  4488. | [68445] Apache CXF UsernameToken Information Disclosure Vulnerability
  4489. | [68441] Apache CXF SAML Tokens Validation Security Bypass Vulnerability
  4490. | [68431] Apache Syncope CVE-2014-3503 Insecure Password Generation Weakness
  4491. | [68229] Apache Harmony PRNG Entropy Weakness
  4492. | [68111] Apache 'mod_wsgi' Module Privilege Escalation Vulnerability
  4493. | [68072] Apache Tomcat CVE-2014-0186 Remote Denial of Service Vulnerability
  4494. | [68039] Apache Hive CVE-2014-0228 Security Bypass Vulnerability
  4495. | [67673] Apache Tomcat CVE-2014-0095 AJP Request Remote Denial Of Service Vulnerability
  4496. | [67671] Apache Tomcat CVE-2014-0075 Chunk Request Remote Denial Of Service Vulnerability
  4497. | [67669] Apache Tomcat CVE-2014-0119 XML External Entity Information Disclosure Vulnerability
  4498. | [67668] Apache Tomcat CVE-2014-0099 Request Processing Information Disclosure Vulnerability
  4499. | [67667] Apache Tomcat CVE-2014-0096 XML External Entity Information Disclosure Vulnerability
  4500. | [67534] Apache 'mod_wsgi' Module CVE-2014-0242 Information Disclosure Vulnerability
  4501. | [67532] Apache 'mod_wsgi' Module Local Privilege Escalation Vulnerability
  4502. | [67530] Apache Solr Search Template Cross Site Scripting Vulnerability
  4503. | [67236] Apache CXF CVE-2014-0109 Remote Denial of Service Vulnerability
  4504. | [67232] Apache CXF CVE-2014-0110 Denial of Service Vulnerability
  4505. | [67121] Apache Struts ClassLoader Manipulation CVE-2014-0114 Security Bypass Vulnerability
  4506. | [67081] Apache Struts 'getClass()' Method Security Bypass Vulnerability
  4507. | [67064] Apache Struts ClassLoader Manipulation Incomplete Fix Security Bypass Vulnerability
  4508. | [67013] Apache Zookeeper CVE-2014-0085 Local Information Disclosure Vulnerability
  4509. | [66998] Apache Archiva CVE-2013-2187 Unspecified Cross Site Scripting Vulnerability
  4510. | [66991] Apache Archiva CVE-2013-2187 HTML Injection Vulnerability
  4511. | [66927] Apache Syncope CVE-2014-0111 Remote Code Execution Vulnerability
  4512. | [66474] Apache CouchDB Universally Unique IDentifier (UUID) Remote Denial of Service Vulnerability
  4513. | [66397] Apache Xalan-Java Library CVE-2014-0107 Security Bypass Vulnerability
  4514. | [66303] Apache HTTP Server Multiple Denial of Service Vulnerabilities
  4515. | [66041] RETIRED: Apache Struts CVE-2014-0094 Classloader Manipulation Security Bypass Vulnerability
  4516. | [65999] Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability
  4517. | [65967] Apache Cordova File-Transfer Unspecified Security Vulnerability
  4518. | [65959] Apache Cordova InAppBrowser Remote Privilege Escalation Vulnerability
  4519. | [65935] Apache Shiro 'login.jsp' Authentication Bypass Vulnerability
  4520. | [65902] Apache Camel CVE-2014-0003 Remote Code Execution Vulnerability
  4521. | [65901] Apache Camel CVE-2014-0002 XML External Entity Information Disclosure Vulnerability
  4522. | [65773] Apache Tomcat CVE-2013-4286 Security Bypass Vulnerability
  4523. | [65769] Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability
  4524. | [65768] Apache Tomcat CVE-2013-4590 XML External Entity Information Disclosure Vulnerability
  4525. | [65767] Apache Tomcat CVE-2013-4322 Incomplete Fix Denial of Service Vulnerability
  4526. | [65615] Apache ActiveMQ 'refresh' Parameter Cross Site Scripting Vulnerability
  4527. | [65434] Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability
  4528. | [65431] Apache Wicket CVE-2013-2055 Information Disclosure Vulnerability
  4529. | [65400] Apache Commons FileUpload CVE-2014-0050 Denial Of Service Vulnerability
  4530. | [64782] Apache CloudStack Virtual Router Component Security Bypass Vulnerability
  4531. | [64780] Apache CloudStack Unauthorized Access Vulnerability
  4532. | [64617] Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
  4533. | [64437] Apache Santuario XML Security For JAVA XML Signature Denial of Service Vulnerability
  4534. | [64427] Apache Solr Multiple XML External Entity Injection Vulnerabilities
  4535. | [64009] Apache Solr CVE-2013-6408 XML External Entity Injection Vulnerability
  4536. | [64008] Apache Solr CVE-2013-6407 XML External Entity Injection Vulnerability
  4537. | [63981] Apache Subversion 'mod_dav_svn' Module Denial of Service Vulnerability
  4538. | [63966] Apache Subversion CVE-2013-4505 Security Bypass Vulnerability
  4539. | [63963] Apache Roller CVE-2013-4171 Cross Site Scripting Vulnerability
  4540. | [63935] Apache Solr 'SolrResourceLoader' Directory Traversal Vulnerability
  4541. | [63928] Apache Roller CVE-2013-4212 OGNL Expression Injection Remote Code Execution Vulnerability
  4542. | [63515] Apache Tomcat Manager Component CVE-2013-6357 Cross Site Request Forgery Vulnerability
  4543. | [63403] Apache Struts Multiple Cross Site Scripting Vulnerabilities
  4544. | [63400] Apache 'mod_pagespeed' Module Unspecified Cross Site Scripting Vulnerability
  4545. | [63260] Apache Shindig CVE-2013-4295 XML External Entity Information Disclosure Vulnerability
  4546. | [63241] Apache Sling 'AbstractAuthenticationFormServlet' Open Redirection Vulnerability
  4547. | [63174] Apache Commons FileUpload 'DiskFileItem' Class Null Byte Arbitrary File Write Vulnerability
  4548. | [62939] Apache 'mod_fcgid' Module CVE-2013-4365 Heap Buffer Overflow Vulnerability
  4549. | [62903] Apache Sling 'deepGetOrCreateNode()' Function Denial Of Service Vulnerability
  4550. | [62706] Apache Camel CVE-2013-4330 Information Disclosure Vulnerability
  4551. | [62677] Apache 'mod_accounting' Module CVE-2013-5697 SQL Injection Vulnerability
  4552. | [62674] TYPO3 Apache Solr Unspecified Cross Site Scripting and PHP Code Execution Vulnerabilities
  4553. | [62587] Apache Struts CVE-2013-4316 Remote Code Execution Vulnerability
  4554. | [62584] Apache Struts CVE-2013-4310 Security Bypass Vulnerability
  4555. | [62266] Apache Subversion CVE-2013-4277 Insecure Temporary File Creation Vulnerability
  4556. | [61984] Apache Hadoop RPC Authentication CVE-2013-2192 Man in the Middle Security Bypass Vulnerability
  4557. | [61981] Apache HBase RPC Authentication Man In The Middle Security Bypass Vulnerability
  4558. | [61638] Apache CloudStack CVE-2013-2136 Multiple Cross Site Scripting Vulnerabilities
  4559. | [61454] Apache Subversion CVE-2013-4131 Denial Of Service Vulnerability
  4560. | [61379] Apache HTTP Server CVE-2013-2249 Unspecified Remote Security Vulnerability
  4561. | [61370] Apache OFBiz CVE-2013-2317 'View Log' Cross Site Scripting Vulnerability
  4562. | [61369] Apache OFBiz Nested Expression Remote Code Execution Vulnerability
  4563. | [61196] Apache Struts CVE-2013-2248 Multiple Open Redirection Vulnerabilities
  4564. | [61189] Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities
  4565. | [61129] Apache HTTP Server CVE-2013-1896 Remote Denial of Service Vulnerability
  4566. | [61030] Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities
  4567. | [60875] Apache Geronimo RMI Classloader Security Bypass Vulnerability
  4568. | [60846] Apache Santuario XML Security for JAVA XML Signature CVE-2013-2172 Security Bypass Vulnerability
  4569. | [60817] Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability
  4570. | [60800] Apache Qpid Python Client SSL Certificate Verification Information Disclosure Vulnerability
  4571. | [60599] Apache Santuario XML Security for C++ CVE-2013-2156 Remote Heap Buffer Overflow Vulnerability
  4572. | [60595] Apache Santuario XML Security for C++ XML Signature CVE-2013-2155 Denial of Service Vulnerability
  4573. | [60594] Apache Santuario XML Security for C++ CVE-2013-2154 Stack Buffer Overflow Vulnerability
  4574. | [60592] Apache Santuario XML Security for C++ XML Signature CVE-2013-2153 Security Bypass Vulnerability
  4575. | [60534] Apache OpenJPA Object Deserialization Arbitrary File Creation or Overwrite Vulnerability
  4576. | [60346] Apache Struts CVE-2013-2134 OGNL Expression Injection Vulnerability
  4577. | [60345] Apache Struts CVE-2013-2135 OGNL Expression Injection Vulnerability
  4578. | [60267] Apache Subversion CVE-2013-1968 Remote Denial of Service Vulnerability
  4579. | [60265] Apache Subversion CVE-2013-2088 Command Injection Vulnerability
  4580. | [60264] Apache Subversion CVE-2013-2112 Remote Denial of Service Vulnerability
  4581. | [60187] Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness
  4582. | [60186] Apache Tomcat CVE-2013-1976 Insecure Temporary File Handling Vulnerability
  4583. | [60167] Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability
  4584. | [60166] Apache Struts 'includeParams' CVE-2013-1966 Security Bypass Vulnerability
  4585. | [60082] Apache Struts 'ParameterInterceptor' Class OGNL CVE-2013-1965 Security Bypass Vulnerability
  4586. | [59826] Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability
  4587. | [59799] Apache Tomcat CVE-2013-2067 Session Fixation Vulnerability
  4588. | [59798] Apache Tomcat CVE-2013-2071 Information Disclosure Vulnerability
  4589. | [59797] Apache Tomcat CVE-2012-3544 Denial of Service Vulnerability
  4590. | [59670] Apache VCL Multiple Input Validation Vulnerabilities
  4591. | [59464] Apache CloudStack CVE-2013-2758 Hash Information Disclosure Vulnerability
  4592. | [59463] Apache CloudStack CVE-2013-2756 Authentication Bypass Vulnerability
  4593. | [59402] Apache ActiveMQ CVE-2013-3060 Information Disclosure and Denial of Service Vulnerability
  4594. | [59401] Apache ActiveMQ CVE-2012-6551 Denial of Service Vulnerability
  4595. | [59400] Apache ActiveMQ CVE-2012-6092 Multiple Cross Site Scripting Vulnerabilities
  4596. | [58898] Apache Subversion CVE-2013-1884 Remote Denial of Service Vulnerability
  4597. | [58897] Apache Subversion 'mod_dav_svn/lock.c' Remote Denial of Service Vulnerability
  4598. | [58895] Apache Subversion 'mod_dav_svn' Remote Denial of Service Vulnerability
  4599. | [58455] Apache Rave User RPC API CVE-2013-1814 Information Disclosure Vulnerability
  4600. | [58379] Apache Qpid CVE-2012-4446 Authentication Bypass Vulnerability
  4601. | [58378] Apache Qpid CVE-2012-4460 Denial of Service Vulnerability
  4602. | [58376] Apache Qpid CVE-2012-4458 Denial of Service Vulnerability
  4603. | [58337] Apache Qpid CVE-2012-4459 Denial of Service Vulnerability
  4604. | [58326] Apache Commons FileUpload CVE-2013-0248 Insecure Temporary File Creation Vulnerability
  4605. | [58325] Debian Apache HTTP Server CVE-2013-1048 Symlink Attack Local Privilege Escalation Vulnerability
  4606. | [58323] Apache Subversion 'svn_fs_file_length()' Remote Denial of Service Vulnerability
  4607. | [58165] Apache  HTTP Server Multiple Cross Site Scripting Vulnerabilities
  4608. | [58136] Apache Maven CVE-2013-0253 SSL Certificate Validation Security Bypass Vulnerability
  4609. | [58124] Apache Tomcat 'log/logdir' Directory Insecure File Permissions Vulnerability
  4610. | [58073] Apache Commons HttpClient CVE-2012-5783 SSL Certificate Validation Security Bypass Vulnerability
  4611. | [57876] Apache CXF WS-SecurityPolicy Authentication Bypass Vulnerability
  4612. | [57874] Apache CXF CVE-2012-5633 Security Bypass Vulnerability
  4613. | [57463] Apache OFBiz CVE-2013-0177 Multiple Cross Site Scripting Vulnerabilities
  4614. | [57425] Apache CXF CVE-2012-5786 SSL Certificate Validation Security Bypass Vulnerability
  4615. | [57321] Apache CouchDB CVE-2012-5650 Cross Site Scripting Vulnerability
  4616. | [57314] Apache CouchDB CVE-2012-5649 Remote Code Execution Vulnerability
  4617. | [57267] Apache Axis2/C SSL Certificate Validation Security Bypass Vulnerability
  4618. | [57259] Apache CloudStack CVE-2012-5616 Local Information Disclosure Vulnerability
  4619. | [56814] Apache Tomcat CVE-2012-4431 Cross-Site Request Forgery Vulnerability
  4620. | [56813] Apache Tomcat CVE-2012-4534 Denial of Service Vulnerability
  4621. | [56812] Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability
  4622. | [56753] Apache Apache HTTP Server 'mod_proxy_ajp Module Denial Of Service Vulnerability
  4623. | [56686] Apache Tomcat CVE-2012-5568 Denial of Service Vulnerability
  4624. | [56408] Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability
  4625. | [56403] Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
  4626. | [56402] Apache Tomcat CVE-2012-2733 Denial of Service Vulnerability
  4627. | [56171] Apache OFBiz CVE-2012-3506 Unspecified Security Vulnerability
  4628. | [55876] Apache CloudStack CVE-2012-4501 Security Bypass Vulnerability
  4629. | [55628] Apache CXF SOAP Action Spoofing Security Bypass Vulnerability
  4630. | [55608] Apache Qpid (qpidd) Denial of Service Vulnerability
  4631. | [55536] Apache 'mod_pagespeed' Module Cross Site Scripting and Security Bypass Vulnerabilities
  4632. | [55508] Apache Axis2 XML Signature Wrapping Security Vulnerability
  4633. | [55445] Apache Wicket CVE-2012-3373 Cross Site Scripting Vulnerability
  4634. | [55346] Apache Struts Cross Site Request Forgery and Denial of Service Vulnerabilities
  4635. | [55290] Drupal Apache Solr Autocomplete Module Cross Site Scripting Vulnerability
  4636. | [55165] Apache Struts2 Skill Name Remote Code Execution Vulnerability
  4637. | [55154] Apache 'mod-rpaf' Module Denial of Service Vulnerability
  4638. | [55131] Apache HTTP Server HTML-Injection And Information Disclosure Vulnerabilities
  4639. | [54954] Apache QPID NullAuthenticator Authentication Bypass Vulnerability
  4640. | [54798] Apache Libcloud Man In The Middle Vulnerability
  4641. | [54358] Apache Hadoop CVE-2012-3376 Information Disclosure Vulnerability
  4642. | [54341] Apache Sling CVE-2012-2138 Denial Of Service Vulnerability
  4643. | [54268] Apache Hadoop Symlink Attack Local Privilege Escalation Vulnerability
  4644. | [54189] Apache Roller Cross Site Request Forgery Vulnerability
  4645. | [54187] Apache Roller CVE-2012-2381 Cross Site Scripting Vulnerability
  4646. | [53880] Apache CXF Child Policies Security Bypass Vulnerability
  4647. | [53877] Apache CXF Elements Validation Security Bypass Vulnerability
  4648. | [53676] Apache Commons Compress and Apache Ant CVE-2012-2098 Denial Of Service Vulnerability
  4649. | [53487] Apache POI CVE-2012-0213 Denial Of Service Vulnerability
  4650. | [53455] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability
  4651. | [53305] Apache Qpid CVE-2011-3620 Unauthorized Access Security Bypass Vulnerability
  4652. | [53046] Apache HTTP Server 'LD_LIBRARY_PATH' Insecure Library Loading Arbitrary Code Execution Vulnerability
  4653. | [53025] Apache OFBiz Unspecified Remote Code Execution Vulnerability
  4654. | [53023] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
  4655. | [52939] Apache Hadoop CVE-2012-1574 Unspecified User Impersonation Vulnerability
  4656. | [52702] Apache Struts2 'XSLTResult.java' Remote Arbitrary File Upload Vulnerability
  4657. | [52696] Apache Traffic Server HTTP Host Header Handling Heap Based Buffer Overflow Vulnerability
  4658. | [52680] Apache Wicket 'pageMapName' Parameter Cross Site Scripting Vulnerability
  4659. | [52679] Apache Wicket Hidden Files Information Disclosure Vulnerability
  4660. | [52565] Apache 'mod_fcgid' Module Denial Of Service Vulnerability
  4661. | [52146] TYPO3 Apache Solr Extension Unspecified Cross Site Scripting Vulnerability
  4662. | [51939] Apache MyFaces 'ln' Parameter Information Disclosure Vulnerability
  4663. | [51917] Apache APR Hash Collision Denial Of Service Vulnerability
  4664. | [51902] Apache Struts Multiple HTML Injection Vulnerabilities
  4665. | [51900] Apache Struts CVE-2012-1007 Multiple Cross Site Scripting Vulnerabilities
  4666. | [51886] Apache CXF UsernameToken Policy Validation Security Bypass Vulnerability
  4667. | [51869] Apache HTTP Server CVE-2011-3639 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
  4668. | [51706] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
  4669. | [51705] Apache HTTP Server CVE-2012-0021 mod_log_config Denial Of Service Vulnerability
  4670. | [51628] Apache Struts 'ParameterInterceptor' Class OGNL (CVE-2011-3923) Security Bypass Vulnerability
  4671. | [51447] Apache Tomcat Parameter Handling Denial of Service Vulnerability
  4672. | [51442] Apache Tomcat Request Object Security Bypass Vulnerability
  4673. | [51407] Apache HTTP Server Scoreboard Local Security Bypass Vulnerability
  4674. | [51257] Apache Struts Remote Command Execution and Arbitrary File Overwrite Vulnerabilities
  4675. | [51238] Apache Geronimo Hash Collision Denial Of Service Vulnerability
  4676. | [51200] Apache Tomcat Hash Collision Denial Of Service Vulnerability
  4677. | [50940] Apache Struts Session Tampering Security Bypass Vulnerability
  4678. | [50912] RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability
  4679. | [50904] Apache ActiveMQ Failover Mechanism Remote Denial Of Service Vulnerability
  4680. | [50848] Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability
  4681. | [50802] Apache HTTP Server 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
  4682. | [50639] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
  4683. | [50603] Apache Tomcat Manager Application Security Bypass Vulnerability
  4684. | [50494] Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
  4685. | [49957] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
  4686. | [49762] Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses
  4687. | [49728] Apache Struts Conversion Error OGNL Expression Evaluation Vulnerability
  4688. | [49616] Apache HTTP Server CVE-2011-3348 Denial Of Service Vulnerability
  4689. | [49470] Apache Tomcat CVE-2007-6286 Duplicate Request Processing Security Vulnerability
  4690. | [49353] Apache Tomcat AJP Protocol Security Bypass Vulnerability
  4691. | [49303] Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability
  4692. | [49290] Apache Wicket Cross Site Scripting Vulnerability
  4693. | [49147] Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability
  4694. | [49143] Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
  4695. | [48667] Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
  4696. | [48653] Apache 'mod_authnz_external' Module SQL Injection Vulnerability
  4697. | [48611] Apache XML Security for C++ Signature Key Parsing Denial of Service Vulnerability
  4698. | [48456] Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability
  4699. | [48015] Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities
  4700. | [48011] Apache Archiva Multiple Cross Site Scripting and HTML Injection Vulnerabilities
  4701. | [47929] Apache APR 'apr_fnmatch.c' Denial of Service Vulnerability
  4702. | [47890] Apache Struts 'javatemplates' Plugin Multiple Cross Site Scripting Vulnerabilities
  4703. | [47886] Apache Tomcat SecurityConstraints Security Bypass Vulnerability
  4704. | [47820] Apache APR 'apr_fnmatch()' Denial of Service Vulnerability
  4705. | [47784] Apache Struts XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability
  4706. | [47199] Apache Tomcat HTTP BIO Connector Information Disclosure Vulnerability
  4707. | [47196] Apache Tomcat Login Constraints Security Bypass Vulnerability
  4708. | [46974] Apache HttpComponents 'HttpClient' Information Disclosure Vulnerability
  4709. | [46953] Apache MPM-ITK Module Security Weakness
  4710. | [46734] Subversion 'mod_dav_svn' Apache Server NULL Pointer Dereference Denial Of Service Vulnerability
  4711. | [46685] Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability
  4712. | [46311] Apache Continuum and Archiva Cross Site Scripting Vulnerability
  4713. | [46177] Apache Tomcat SecurityManager Security Bypass Vulnerability
  4714. | [46174] Apache Tomcat HTML Manager Interface HTML Injection Vulnerability
  4715. | [46166] Apache Tomcat JVM Denial of Service Vulnerability
  4716. | [46164] Apache Tomcat NIO Connector Denial of Service Vulnerability
  4717. | [46066] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
  4718. | [45655] Apache Subversion Server Component Multiple Remote Denial Of Service Vulnerabilities
  4719. | [45123] Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
  4720. | [45095] Apache Archiva Cross Site Request Forgery Vulnerability
  4721. | [45015] Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities
  4722. | [44900] Apache 'mod_fcgid' Module Unspecified Stack Buffer Overflow Vulnerability
  4723. | [44616] Apache Shiro Directory Traversal Vulnerability
  4724. | [44355] Apache MyFaces Encrypted View State Oracle Padding Security Vulnerability
  4725. | [44068] Apache::AuthenHook Local Information Disclosure Vulnerability
  4726. | [43862] Apache QPID SSL Connection Denial of Service Vulnerability
  4727. | [43673] Apache APR-util 'apr_brigade_split_line()' Denial of Service Vulnerability
  4728. | [43637] Apache XML-RPC SAX Parser Information Disclosure Vulnerability
  4729. | [43111] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
  4730. | [42637] Apache Derby 'BUILTIN' Authentication Insecure Password Hashing Vulnerability
  4731. | [42501] Apache CouchDB Cross Site Request Forgery Vulnerability
  4732. | [42492] Apache CXF XML DTD Processing Security Vulnerability
  4733. | [42121] Apache SLMS Insufficient Quoting Cross Site Request Forgery Vulnerability
  4734. | [42102] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
  4735. | [41963] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
  4736. | [41544] Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
  4737. | [41076] Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability
  4738. | [40976] Apache Axis2 Document Type Declaration Processing Security Vulnerability
  4739. | [40827] Apache 'mod_proxy_http' Timeout Handling Information Disclosure Vulnerability
  4740. | [40343] Apache Axis2 'xsd' Parameter Directory Traversal Vulnerability
  4741. | [40327] Apache Axis2 'engagingglobally' Cross-Site Scripting Vulnerability
  4742. | [39771] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
  4743. | [39636] Apache ActiveMQ Source Code Information Disclosure Vulnerability
  4744. | [39635] Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability
  4745. | [39538] Apache mod_auth_shadow Race Condition Security Bypass Vulnerability
  4746. | [39489] Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities
  4747. | [39119] Apache ActiveMQ 'createDestination.action' HTML Injection Vulnerability
  4748. | [38580] Apache Subrequest Handling Information Disclosure Vulnerability
  4749. | [38494] Apache 'mod_isapi' Memory Corruption Vulnerability
  4750. | [38491] Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
  4751. | [37966] Apache 1.3 mod_proxy HTTP Chunked Encoding Integer Overflow Vulnerability
  4752. | [37945] Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
  4753. | [37944] Apache Tomcat WAR File Directory Traversal Vulnerability
  4754. | [37942] Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability
  4755. | [37149] Apache Tomcat 404 Error Page Cross Site Scripting Vulnerability
  4756. | [37027] RETIRED: Apache APR 'apr_uri_parse_hostinfo' Off By One Remote Code Execution Vulnerability
  4757. | [36990] Apache HTTP TRACE Cross Site Scripting Vulnerability
  4758. | [36954] Apache Tomcat Windows Installer Insecure Password Vulnerability
  4759. | [36889] TYPO3 Apache Solr Search Extension Unspecified Cross Site Scripting Vulnerability
  4760. | [36596] Apache HTTP Server Solaris Event Port Pollset Support Remote Denial Of Service Vulnerability
  4761. | [36260] Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
  4762. | [36254] Apache mod_proxy_ftp Remote Command Injection Vulnerability
  4763. | [35949] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
  4764. | [35840] Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
  4765. | [35623] Apache 'mod_deflate' Remote Denial Of Service Vulnerability
  4766. | [35565] Apache 'mod_proxy' Remote Denial Of Service Vulnerability
  4767. | [35416] Apache Tomcat XML Parser Information Disclosure Vulnerability
  4768. | [35263] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
  4769. | [35253] Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
  4770. | [35251] Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
  4771. | [35221] Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
  4772. | [35196] Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
  4773. | [35193] Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
  4774. | [35115] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
  4775. | [34686] Apache Struts Multiple Cross Site Scripting Vulnerabilities
  4776. | [34663] Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
  4777. | [34657] Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities
  4778. | [34562] Apache Geronimo Application Server Multiple Remote Vulnerabilities
  4779. | [34552] Apache ActiveMQ Web Console Multiple Unspecified HTML Injection Vulnerabilities
  4780. | [34412] Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability
  4781. | [34399] Apache Struts Unspecified Cross Site Scripting Vulnerability
  4782. | [34383] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
  4783. | [33913] Apache Tomcat POST Data Information Disclosure Vulnerability
  4784. | [33360] Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities
  4785. | [33110] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
  4786. | [32657] Novell NetWare ApacheAdmin Security Bypass Vulnerability
  4787. | [31805] Apache HTTP Server OS Fingerprinting Unspecified Security Vulnerability
  4788. | [31761] Oracle WebLogic Server Apache Connector Stack Based Buffer Overflow Vulnerability
  4789. | [31698] Apache Tomcat 'RemoteFilterValve' Security Bypass Vulnerability
  4790. | [31165] Kolab Groupware Server Apache Log File User Password Information Disclosure Vulnerability
  4791. | [30560] Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
  4792. | [30496] Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
  4793. | [30494] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
  4794. | [29653] Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
  4795. | [29502] Apache Tomcat Host Manager Cross Site Scripting Vulnerability
  4796. | [28576] Apache-SSL Environment Variable Information Disclosure and Privilege Escalation Vulnerability
  4797. | [28484] Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability
  4798. | [28483] Apache Tomcat 'allowLinking' Accepts NULL Byte in URI Information Disclosure Vulnerability
  4799. | [28482] Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability
  4800. | [28481] Apache Tomcat Cross-Site Scripting Vulnerability
  4801. | [28477] Apache Tomcat AJP Connector Information Disclosure Vulnerability
  4802. | [27752] Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
  4803. | [27706] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
  4804. | [27703] Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
  4805. | [27409] Apache 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
  4806. | [27365] Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
  4807. | [27237] Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
  4808. | [27236] Apache 'mod_proxy_balancer' Multiple Vulnerabilities
  4809. | [27234] Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scripting Vulnerability
  4810. | [27006] Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
  4811. | [26939] Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
  4812. | [26838] Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
  4813. | [26762] Apache::AuthCAS Cookie SQL Injection Vulnerability
  4814. | [26663] Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness
  4815. | [26287] Apache Geronimo SQLLoginModule Authentication Bypass Vulnerability
  4816. | [26070] Apache Tomcat WebDav Remote Information Disclosure Vulnerability
  4817. | [25804] Apache Geronimo Management EJB Security Bypass Vulnerability
  4818. | [25653] Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
  4819. | [25531] Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
  4820. | [25489] Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
  4821. | [25316] Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
  4822. | [25314] Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
  4823. | [25174] Apache Tomcat Error Message Reporting Cross Site Scripting Vulnerability
  4824. | [24999] Apache Tomcat SendMailServlet Cross-Site Scripting Vulnerability
  4825. | [24759] MySQLDumper Apache Access Control Authentication Bypass Vulnerability
  4826. | [24649] Apache HTTP Server Mod_Cache Denial of Service Vulnerability
  4827. | [24645] Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
  4828. | [24553] Apache Mod_Mem_Cache Information Disclosure Vulnerability
  4829. | [24524] Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
  4830. | [24480] Apache MyFaces Tomahawk JSF Framework Autoscroll Parameter Cross Site Scripting Vulnerability
  4831. | [24476] Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
  4832. | [24475] Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
  4833. | [24215] Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
  4834. | [24147] Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
  4835. | [24058] Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
  4836. | [23687] Apache AXIS Non-Existent WSDL Path Information Disclosure Vulnerability
  4837. | [23438] Apache HTTPD suEXEC Local Multiple Privilege Escalation Weaknesses
  4838. | [22960] Apache HTTP Server Tomcat Directory Traversal Vulnerability
  4839. | [22849] Apache mod_python Output Filter Mode Information Disclosure Vulnerability
  4840. | [22791] Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability
  4841. | [22732] Debian Apache Root Shell Local Privilege Escalation Vulnerabilities
  4842. | [22388] Apache Stats Extract Function Multiple Input Validation Vulnerabilities
  4843. | [21865] Apache And Microsoft IIS Range Denial of Service Vulnerability
  4844. | [21214] Apache Mod_Auth_Kerb Off-By-One Denial of Service Vulnerability
  4845. | [20527] Apache Mod_TCL Remote Format String Vulnerability
  4846. | [19661] Apache HTTP Server Arbitrary HTTP Request Headers Security Weakness
  4847. | [19447] Apache CGI Script Source Code Information Disclosure Vulnerability
  4848. | [19204] Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
  4849. | [19106] Apache Tomcat Information Disclosure Vulnerability
  4850. | [18138] Apache James SMTP Denial Of Service Vulnerability
  4851. | [17342] Apache Struts Multiple Remote Vulnerabilities
  4852. | [17095] Apache Log4Net Denial Of Service Vulnerability
  4853. | [16916] Apache mod_python FileSession Code Execution Vulnerability
  4854. | [16710] Apache Libapreq2 Quadratic Behavior Denial of Service Vulnerability
  4855. | [16260] Apache Geronimo Multiple Input Validation Vulnerabilities
  4856. | [16153] Apache mod_auth_pgsql Multiple Format String Vulnerabilities
  4857. | [16152] Apache Mod_SSL Custom Error Document Remote Denial Of Service Vulnerability
  4858. | [15834] Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability
  4859. | [15765] Apache James Spooler Memory Leak Denial Of Service Vulnerability
  4860. | [15762] Apache MPM Worker.C Denial Of Service Vulnerability
  4861. | [15512] Apache Struts Error Response Cross-Site Scripting Vulnerability
  4862. | [15413] PHP Apache 2 Virtual() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
  4863. | [15325] Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
  4864. | [15224] Apache Mod_Auth_Shadow Authentication Bypass Vulnerability
  4865. | [15177] PHP Apache 2 Local Denial of Service Vulnerability
  4866. | [14982] ApacheTop Insecure Temporary File Creation Vulnerability
  4867. | [14721] Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
  4868. | [14660] Apache CGI Byterange Request Denial of Service Vulnerability
  4869. | [14366] Apache mod_ssl CRL Handling Off-By-One Buffer Overflow Vulnerability
  4870. | [14106] Apache HTTP Request Smuggling Vulnerability
  4871. | [13778] Apache HTPasswd Password Command Line Argument Buffer Overflow Vulnerability
  4872. | [13777] Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability
  4873. | [13756] Apache Tomcat Java Security Manager Bypass Vulnerability
  4874. | [13537] Apache HTDigest Realm Command Line Argument Buffer Overflow Vulnerability
  4875. | [12877] Apache mod_ssl ssl_io_filter_cleanup Remote Denial Of Service Vulnerability
  4876. | [12795] Apache Tomcat Remote Malformed Request Denial Of Service Vulnerability
  4877. | [12619] Apache Software Foundation Batik Squiggle Browser Access Validation Vulnerability
  4878. | [12519] Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
  4879. | [12308] Apache Utilities Insecure Temporary File Creation Vulnerability
  4880. | [12217] Apache mod_auth_radius Malformed RADIUS Server Reply Integer Overflow Vulnerability
  4881. | [12181] Mod_DOSEvasive Apache Module Local Insecure Temporary File Creation Vulnerability
  4882. | [11803] Apache Jakarta Results.JSP Remote Cross-Site Scripting Vulnerability
  4883. | [11471] Apache mod_include Local Buffer Overflow Vulnerability
  4884. | [11360] Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
  4885. | [11239] Apache Satisfy Directive Access Control Bypass Vulnerability
  4886. | [11187] Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
  4887. | [11185] Apache Mod_DAV LOCK Denial Of Service Vulnerability
  4888. | [11182] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
  4889. | [11154] Apache mod_ssl Remote Denial of Service Vulnerability
  4890. | [11094] Apache mod_ssl Denial Of Service Vulnerability
  4891. | [10789] Apache mod_userdir Module Information Disclosure Vulnerability
  4892. | [10736] Apache 'mod_ssl' Log Function Format String Vulnerability
  4893. | [10619] Apache ap_escape_html Memory Allocation Denial Of Service Vulnerability
  4894. | [10508] Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
  4895. | [10478] ClueCentral Apache Suexec Patch Security Weakness
  4896. | [10355] Apache 'mod_ssl' 'ssl_util_uuencode_binary()'  Stack Buffer Overflow Vulnerability
  4897. | [10212] Apache mod_auth Malformed Password Potential Memory Corruption Vulnerability
  4898. | [9933] Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
  4899. | [9930] Apache Error and Access Logs Escape Sequence Injection Vulnerability
  4900. | [9921] Apache Connection Blocking Denial Of Service Vulnerability
  4901. | [9885] Apache Mod_Security Module SecFilterScanPost Off-By-One Buffer Overflow Vulnerability
  4902. | [9874] Apache HTAccess LIMIT Directive Bypass Configuration Error Weakness
  4903. | [9829] Apache Mod_Access Access Control Rule Bypass Vulnerability
  4904. | [9826] Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnerability
  4905. | [9733] Apache Cygwin Directory Traversal Vulnerability
  4906. | [9599] Apache mod_php Global Variables Information Disclosure Weakness
  4907. | [9590] Apache-SSL Client Certificate Forging Vulnerability
  4908. | [9571] Apache mod_digest Client-Supplied Nonce Verification Vulnerability
  4909. | [9471] Apache mod_perl Module File Descriptor Leakage Vulnerability
  4910. | [9404] Mod-Auth-Shadow Apache Module Expired User Credential Weakness
  4911. | [9302] Apache mod_php Module File Descriptor Leakage Vulnerability
  4912. | [9129] Apache mod_python Module Malformed Query Denial of Service Vulnerability
  4913. | [8926] Apache Web Server mod_cgid Module CGI Data Redirection Vulnerability
  4914. | [8919] Apache Mod_Security Module Heap Corruption Vulnerability
  4915. | [8911] Apache Web Server Multiple Module Local Buffer Overflow Vulnerability
  4916. | [8898] Red Hat Apache Directory Index Default Configuration Error
  4917. | [8883] Apache Cocoon Directory Traversal Vulnerability
  4918. | [8824] Apache Tomcat Non-HTTP Request Denial Of Service Vulnerability
  4919. | [8822] Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
  4920. | [8725] Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
  4921. | [8707] Apache htpasswd Password Entropy Weakness
  4922. | [8561] Apache::Gallery Insecure Local File Storage Privilege Escalation Vulnerability
  4923. | [8287] Mod_Mylo Apache Module REQSTR Buffer Overflow Vulnerability
  4924. | [8226] Apache HTTP Server Multiple Vulnerabilities
  4925. | [8138] Apache Web Server Type-Map Recursive Loop Denial Of Service Vulnerability
  4926. | [8137] Apache Web Server Prefork MPM Denial Of Service Vulnerability
  4927. | [8136] Macromedia Apache Web Server Encoded Space Source Disclosure Vulnerability
  4928. | [8135] Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
  4929. | [8134] Apache Web Server SSLCipherSuite Weak CipherSuite Renegotiation Weakness
  4930. | [7768] Apache Tomcat Insecure Directory Permissions Vulnerability
  4931. | [7725] Apache Basic Authentication Module Valid User Login Denial Of Service Vulnerability
  4932. | [7723] Apache APR_PSPrintf Memory Corruption Vulnerability
  4933. | [7448] Apache Mod_Auth_Any Remote Command Execution Vulnerability
  4934. | [7375] Apache Mod_Access_Referer NULL Pointer Dereference Denial of Service Vulnerability
  4935. | [7332] Apache Web Server OS2 Filestat Denial Of Service Vulnerability
  4936. | [7255] Apache Web Server File Descriptor Leakage Vulnerability
  4937. | [7254] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
  4938. | [6943] Apache Web Server MIME Boundary Information Disclosure Vulnerability
  4939. | [6939] Apache Web Server ETag Header Information Disclosure Weakness
  4940. | [6722] Apache Tomcat Web.XML File Contents Disclosure Vulnerability
  4941. | [6721] Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
  4942. | [6720] Apache Tomcat Example Web Application Cross Site Scripting Vulnerability
  4943. | [6662] Apache Web Server MS-DOS Device Name Denial Of Service Vulnerability
  4944. | [6661] Apache Web Server Default Script Mapping Bypass Vulnerability
  4945. | [6660] Apache Web Server Illegal Character HTTP Request File Disclosure Vulnerability
  4946. | [6659] Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability
  4947. | [6562] Apache Tomcat Invoker Servlet File Disclosure Vulnerability
  4948. | [6320] Apache/Tomcat Mod_JK Chunked Encoding Denial Of Service Vulnerability
  4949. | [6117] Apache mod_php File Descriptor Leakage Vulnerability
  4950. | [6065] Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability
  4951. | [5996] Apache AB.C Web Benchmarking Buffer Overflow Vulnerability
  4952. | [5995] Apache AB.C Web Benchmarking Read_Connection() Buffer Overflow Vulnerability
  4953. | [5993] Multiple Apache HTDigest Buffer Overflow Vulnerabilities
  4954. | [5992] Apache HTDigest Insecure Temporary File Vulnerability
  4955. | [5991] Apache HTDigest Arbitrary Command Execution Vulnerability
  4956. | [5990] Apache HTPasswd Insecure Temporary File Vulnerability
  4957. | [5981] Multiple Apache HTDigest and HTPassWD Component Vulnerabilites
  4958. | [5884] Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1 Sending Vulnerability
  4959. | [5847] Apache Server Side Include Cross Site Scripting Vulnerability
  4960. | [5838] Apache Tomcat 3.2 Directory Disclosure Vulnerability
  4961. | [5816] Apache 2 mod_dav Denial Of Service Vulnerability
  4962. | [5791] HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
  4963. | [5787] Apache Oversized STDERR Buffer Denial Of Service Vulnerability
  4964. | [5786] Apache Tomcat DefaultServlet File Disclosure Vulnerability
  4965. | [5542] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
  4966. | [5486] Apache 2.0 CGI Path Disclosure Vulnerability
  4967. | [5485] Apache 2.0 Path Disclosure Vulnerability
  4968. | [5434] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
  4969. | [5256] Apache httpd 2.0 CGI Error Path Disclosure Vulnerability
  4970. | [5194] Apache Tomcat DOS Device Name Cross Site Scripting Vulnerability
  4971. | [5193] Apache Tomcat Servlet Mapping Cross Site Scripting Vulnerability
  4972. | [5067] Apache Tomcat Null Character Malformed Request Denial Of Service Vulnerability
  4973. | [5054] Apache Tomcat  Web Root Path Disclosure Vulnerability
  4974. | [5033] Apache Chunked-Encoding Memory Corruption Vulnerability
  4975. | [4995] Apache Tomcat JSP Engine Denial of Service Vulnerability
  4976. | [4878] Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
  4977. | [4877] Apache Tomcat Example Files Web Root Path Disclosure Vulnerability
  4978. | [4876] Apache Tomcat Source.JSP Malformed Request Information Disclosure Vulnerability
  4979. | [4575] Apache Tomcat Servlet Path Disclosure Vulnerability
  4980. | [4557] Apache Tomcat System Path Information Disclosure Vulnerability
  4981. | [4437] Apache Error Message Cross-Site Scripting Vulnerability
  4982. | [4431] Apache PrintEnv/Test_CGI Script Injection Vulnerability
  4983. | [4358] Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
  4984. | [4335] Apache Win32 Batch File Remote Command Execution Vulnerability
  4985. | [4292] Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
  4986. | [4189] Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
  4987. | [4057] Apache 2 for Windows OPTIONS request Path Disclosure Vulnerability
  4988. | [4056] Apache 2 for Windows php.exe Path Disclosure Vulnerability
  4989. | [4037] Oracle 9iAS Apache PL/SQL Module Denial of Service Vulnerability
  4990. | [4032] Oracle 9iAS Apache PL/SQL Module Multiple Buffer Overflows Vulnerability
  4991. | [3796] Apache HTTP Request Unexpected Behavior Vulnerability
  4992. | [3790] Apache Non-Existent Log Directory Denial Of Service Vulnerability
  4993. | [3786] Apache Win32 PHP.EXE Remote File Disclosure Vulnerability
  4994. | [3727] Oracle 9I Application Server PL/SQL Apache Module Directory Traversal Vulnerability
  4995. | [3726] Oracle 9I Application Server PL/SQL Apache Module Buffer Overflow Vulnerability
  4996. | [3596] Apache Split-Logfile File Append Vulnerability
  4997. | [3521] Apache mod_usertrack Predictable ID Generation Vulnerability
  4998. | [3335] Red Hat Linux Apache Remote Username Enumeration Vulnerability
  4999. | [3316] MacOS X Client Apache Directory Contents Disclosure Vulnerability
  5000. | [3256] Apache mod_auth_oracle Remote SQL Query Manipulation Vulnerability
  5001. | [3255] Apache mod_auth_mysql Remote SQL Query Manipulation Vulnerability
  5002. | [3254] Apache AuthPG Remote SQL Query Manipulation Vulnerability
  5003. | [3253] Apache mod_auth_pgsql_sys Remote SQL Query Manipulation Vulnerability
  5004. | [3251] Apache mod_auth_pgsql Remote SQL Query Manipulation Vulnerability
  5005. | [3176] Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
  5006. | [3169] Apache Server Address Disclosure Vulnerability
  5007. | [3009] Apache Possible Directory Index Disclosure Vulnerability
  5008. | [2982] Apache Tomcat Cross-Site Scripting Vulnerability
  5009. | [2852] MacOS X Client Apache File Protection Bypass Vulnerability
  5010. | [2740] Apache Web Server HTTP Request Denial of Service Vulnerability
  5011. | [2518] Apache Tomcat 3.0 Directory Traversal Vulnerability
  5012. | [2503] Apache Artificially Long Slash Path Directory Listing Vulnerability
  5013. | [2300] NCSA/Apache httpd ScriptAlias Source Retrieval Vulnerability
  5014. | [2216] Apache Web Server DoS Vulnerability
  5015. | [2182] Apache /tmp File Race Vulnerability
  5016. | [2171] Oracle Apache+WebDB Documented Backdoor Vulnerability
  5017. | [2060] Apache Web Server with Php 3 File Disclosure Vulnerability
  5018. | [1821] Apache mod_cookies Buffer Overflow Vulnerability
  5019. | [1728] Apache Rewrite Module Arbitrary File Disclosure Vulnerability
  5020. | [1658] SuSE Apache CGI Source Code Viewing Vulnerability
  5021. | [1656] SuSE Apache WebDAV Directory Listings Vulnerability
  5022. | [1575] Trustix Apache-SSL RPM Permissions Vulnerability
  5023. | [1548] Apache Jakarta-Tomcat /admin Context Vulnerability
  5024. | [1532] Apache Tomcat Snoop Servlet Information Disclosure Vulnerability
  5025. | [1531] Apache Tomcat 3.1 Path Revealing Vulnerability
  5026. | [1457] Apache::ASP source.asp Example Script Vulnerability
  5027. | [1284] Apache HTTP Server (win32) Root Directory Access Vulnerability
  5028. | [1083] Cobalt Raq Apache .htaccess Disclosure Vulnerability
  5029. |
  5030. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  5031. | [86258] Apache CloudStack text fields cross-site scripting
  5032. | [85983] Apache Subversion mod_dav_svn module denial of service
  5033. | [85875] Apache OFBiz UEL code execution
  5034. | [85874] Apache OFBiz Webtools View Log screen cross-site scripting
  5035. | [85871] Apache HTTP Server mod_session_dbd  unspecified
  5036. | [85756] Apache Struts OGNL expression command execution
  5037. | [85755] Apache Struts DefaultActionMapper class open redirect
  5038. | [85586] Apache ActiveMQ CVE-2013-1879 cross-site scripting
  5039. | [85574] Apache HTTP Server mod_dav denial of service
  5040. | [85573] Apache Struts Showcase App OGNL code execution
  5041. | [85496] Apache CXF denial of service
  5042. | [85423] Apache Geronimo RMI classloader code execution
  5043. | [85326] Apache Santuario XML Security for C++ buffer overflow
  5044. | [85323] Apache Santuario XML Security for Java spoofing
  5045. | [85319] Apache Qpid Python client SSL spoofing
  5046. | [85019] Apache Santuario XML Security for C++ CVE-2013-2156 buffer overflow
  5047. | [85018] Apache Santuario XML Security for C++ CVE-2013-2155 denial of service
  5048. | [85017] Apache Santuario XML Security for C++ CVE-2013-2154 buffer overflow
  5049. | [85016] Apache Santuario XML Security for C++ CVE-2013-2153 spoofing
  5050. | [84952] Apache Tomcat CVE-2012-3544 denial of service
  5051. | [84763] Apache Struts CVE-2013-2135 security bypass
  5052. | [84762] Apache Struts CVE-2013-2134 security bypass
  5053. | [84719] Apache Subversion CVE-2013-2088 command execution
  5054. | [84718] Apache Subversion CVE-2013-2112 denial of service
  5055. | [84717] Apache Subversion CVE-2013-1968 denial of service
  5056. | [84577] Apache Tomcat security bypass
  5057. | [84576] Apache Tomcat symlink
  5058. | [84543] Apache Struts CVE-2013-2115 security bypass
  5059. | [84542] Apache Struts CVE-2013-1966 security bypass
  5060. | [84154] Apache Tomcat session hijacking
  5061. | [84144] Apache Tomcat denial of service
  5062. | [84143] Apache Tomcat information disclosure
  5063. | [84111] Apache HTTP Server command execution
  5064. | [84043] Apache Virtual Computing Lab cross-site scripting
  5065. | [84042] Apache Virtual Computing Lab cross-site scripting
  5066. | [83782] Apache CloudStack information disclosure
  5067. | [83781] Apache CloudStack security bypass
  5068. | [83720] Apache ActiveMQ cross-site scripting
  5069. | [83719] Apache ActiveMQ denial of service
  5070. | [83718] Apache ActiveMQ denial of service
  5071. | [83263] Apache Subversion denial of service
  5072. | [83262] Apache Subversion denial of service
  5073. | [83261] Apache Subversion denial of service
  5074. | [83259] Apache Subversion denial of service
  5075. | [83035] Apache mod_ruid2 security bypass
  5076. | [82852] Apache Qpid federation_tag security bypass
  5077. | [82851] Apache Qpid qpid::framing::Buffer denial of service
  5078. | [82758] Apache Rave User RPC API information disclosure
  5079. | [82663] Apache Subversion svn_fs_file_length() denial of service
  5080. | [82642] Apache Qpid qpid::framing::Buffer::checkAvailable() denial of service
  5081. | [82641] Apache Qpid AMQP denial of service
  5082. | [82626] Apache HTTP Server on Debian GNU/Linux  Debian apache2ctl symlink
  5083. | [82618] Apache Commons FileUpload symlink
  5084. | [82360] Apache HTTP Server manager interface cross-site scripting
  5085. | [82359] Apache HTTP Server hostnames cross-site scripting
  5086. | [82338] Apache Tomcat log/logdir information disclosure
  5087. | [82328] Apache Maven and Apache Maven Wagon SSL spoofing
  5088. | [82268] Apache OpenJPA deserialization command execution
  5089. | [81981] Apache CXF UsernameTokens security bypass
  5090. | [81980] Apache CXF WS-Security security bypass
  5091. | [81398] Apache OFBiz cross-site scripting
  5092. | [81240] Apache CouchDB directory traversal
  5093. | [81226] Apache CouchDB JSONP code execution
  5094. | [81225] Apache CouchDB Futon user interface cross-site scripting
  5095. | [81211] Apache Axis2/C SSL spoofing
  5096. | [81167] Apache CloudStack DeployVM information disclosure
  5097. | [81166] Apache CloudStack AddHost API information disclosure
  5098. | [81165] Apache CloudStack createSSHKeyPair API information disclosure
  5099. | [80518] Apache Tomcat cross-site request forgery security bypass
  5100. | [80517] Apache Tomcat FormAuthenticator security bypass
  5101. | [80516] Apache Tomcat NIO denial of service
  5102. | [80408] Apache Tomcat replay-countermeasure security bypass
  5103. | [80407] Apache Tomcat HTTP Digest Access Authentication security bypass
  5104. | [80317] Apache Tomcat slowloris denial of service
  5105. | [79984] Apache Commons HttpClient SSL spoofing
  5106. | [79983] Apache CXF SSL spoofing
  5107. | [79830] Apache Axis2/Java SSL spoofing
  5108. | [79829] Apache Axis SSL spoofing
  5109. | [79809] Apache Tomcat DIGEST security bypass
  5110. | [79806] Apache Tomcat parseHeaders() denial of service
  5111. | [79540] Apache OFBiz unspecified
  5112. | [79487] Apache Axis2 SAML security bypass
  5113. | [79212] Apache Cloudstack code execution
  5114. | [78734] Apache CXF SOAP Action security bypass
  5115. | [78730] Apache Qpid broker denial of service
  5116. | [78617] Eucalyptus Apache Santuario (XML Security for Java) denial of service
  5117. | [78563] Apache mod_pagespeed module unspecified cross-site scripting
  5118. | [78562] Apache mod_pagespeed module security bypass
  5119. | [78454] Apache Axis2 security bypass
  5120. | [78452] Websense Web Security and Web Filter Apache Tomcat information disclosure
  5121. | [78451] Websense Web Security and Web Filter Apache Tomcat cross-site scripting
  5122. | [78321] Apache Wicket unspecified cross-site scripting
  5123. | [78183] Apache Struts parameters denial of service
  5124. | [78182] Apache Struts cross-site request forgery
  5125. | [78153] Apache Solr Autocomplete module for Drupal autocomplete results cross-site scripting
  5126. | [77987] mod_rpaf module for Apache denial of service
  5127. | [77958] Apache Struts skill name code execution
  5128. | [77914] Apache HTTP Server mod_negotiation module cross-site scripting
  5129. | [77913] Apache HTTP Server mod_proxy_ajp information disclosure
  5130. | [77568] Apache Qpid broker security bypass
  5131. | [77421] Apache Libcloud spoofing
  5132. | [77059] Oracle Solaris Cluster Apache Tomcat Agent unspecified
  5133. | [77046] Oracle Solaris Apache HTTP Server information disclosure
  5134. | [76837] Apache Hadoop information disclosure
  5135. | [76802] Apache Sling CopyFrom denial of service
  5136. | [76692] Apache Hadoop symlink
  5137. | [76535] Apache Roller console cross-site request forgery
  5138. | [76534] Apache Roller weblog cross-site scripting
  5139. | [76152] Apache CXF elements security bypass
  5140. | [76151] Apache CXF child policies security bypass
  5141. | [75983] MapServer for Windows Apache file include
  5142. | [75857] Apache Commons Compress and Apache Ant bzip2 denial of service
  5143. | [75558] Apache POI denial of service
  5144. | [75545] PHP apache_request_headers() buffer overflow
  5145. | [75302] Apache Qpid SASL security bypass
  5146. | [75211] Debian GNU/Linux apache 2 cross-site scripting
  5147. | [74901] Apache HTTP Server LD_LIBRARY_PATH privilege escalation
  5148. | [74871] Apache OFBiz FlexibleStringExpander code execution
  5149. | [74870] Apache OFBiz multiple cross-site scripting
  5150. | [74750] Apache Hadoop unspecified spoofing
  5151. | [74319] Apache Struts XSLTResult.java file upload
  5152. | [74313] Apache Traffic Server header buffer overflow
  5153. | [74276] Apache Wicket directory traversal
  5154. | [74273] Apache Wicket unspecified cross-site scripting
  5155. | [74181] Apache HTTP Server mod_fcgid module denial of service
  5156. | [73690] Apache Struts OGNL code execution
  5157. | [73432] Apache Solr extension for TYPO3 unspecified cross-site scripting
  5158. | [73100] Apache MyFaces in directory traversal
  5159. | [73096] Apache APR hash denial of service
  5160. | [73052] Apache Struts name cross-site scripting
  5161. | [73030] Apache CXF UsernameToken security bypass
  5162. | [72888] Apache Struts lastName cross-site scripting
  5163. | [72758] Apache HTTP Server httpOnly information disclosure
  5164. | [72757] Apache HTTP Server MPM denial of service
  5165. | [72585] Apache Struts ParameterInterceptor security bypass
  5166. | [72438] Apache Tomcat Digest security bypass
  5167. | [72437] Apache Tomcat Digest security bypass
  5168. | [72436] Apache Tomcat DIGEST security bypass
  5169. | [72425] Apache Tomcat parameter denial of service
  5170. | [72422] Apache Tomcat request object information disclosure
  5171. | [72377] Apache HTTP Server scoreboard security bypass
  5172. | [72345] Apache HTTP Server HTTP request denial of service
  5173. | [72229] Apache Struts ExceptionDelegator command execution
  5174. | [72089] Apache Struts ParameterInterceptor directory traversal
  5175. | [72088] Apache Struts CookieInterceptor command execution
  5176. | [72047] Apache Geronimo hash denial of service
  5177. | [72016] Apache Tomcat hash denial of service
  5178. | [71711] Apache Struts OGNL expression code execution
  5179. | [71654] Apache Struts interfaces security bypass
  5180. | [71620] Apache ActiveMQ failover denial of service
  5181. | [71617] Apache HTTP Server mod_proxy module information disclosure
  5182. | [71508] Apache MyFaces EL security bypass
  5183. | [71445] Apache HTTP Server mod_proxy security bypass
  5184. | [71203] Apache Tomcat servlets privilege escalation
  5185. | [71181] Apache HTTP Server ap_pregsub() denial of service
  5186. | [71093] Apache HTTP Server ap_pregsub() buffer overflow
  5187. | [70336] Apache HTTP Server mod_proxy information disclosure
  5188. | [69804] Apache HTTP Server mod_proxy_ajp denial of service
  5189. | [69472] Apache Tomcat AJP security bypass
  5190. | [69396] Apache HTTP Server ByteRange filter denial of service
  5191. | [69394] Apache Wicket multi window support cross-site scripting
  5192. | [69176] Apache Tomcat XML information disclosure
  5193. | [69161] Apache Tomcat jsvc information disclosure
  5194. | [68799] mod_authnz_external module for Apache mysql-auth.pl SQL injection
  5195. | [68541] Apache Tomcat sendfile information disclosure
  5196. | [68420] Apache XML Security denial of service
  5197. | [68238] Apache Tomcat JMX information disclosure
  5198. | [67860] Apache Rampart/C rampart_timestamp_token_validate security bypass
  5199. | [67804] Apache Subversion control rules information disclosure
  5200. | [67803] Apache Subversion control rules denial of service
  5201. | [67802] Apache Subversion baselined denial of service
  5202. | [67672] Apache Archiva multiple cross-site scripting
  5203. | [67671] Apache Archiva multiple cross-site request forgery
  5204. | [67564] Apache APR apr_fnmatch() denial of service
  5205. | [67532] IBM WebSphere Application Server org.apache.jasper.runtime.JspWriterImpl.response denial of service
  5206. | [67515] Apache Tomcat annotations security bypass
  5207. | [67480] Apache Struts s:submit information disclosure
  5208. | [67414] Apache APR apr_fnmatch() denial of service
  5209. | [67356] Apache Struts javatemplates cross-site scripting
  5210. | [67354] Apache Struts Xwork cross-site scripting
  5211. | [66676] Apache Tomcat HTTP BIO information disclosure
  5212. | [66675] Apache Tomcat web.xml security bypass
  5213. | [66640] Apache HttpComponents HttpClient Proxy-Authorization information disclosure
  5214. | [66241] Apache HttpComponents information disclosure
  5215. | [66154] Apache Tomcat ServletSecurity security bypass
  5216. | [65971] Apache Tomcat ServletSecurity security bypass
  5217. | [65876] Apache Subversion mod_dav_svn denial of service
  5218. | [65343] Apache Continuum unspecified cross-site scripting
  5219. | [65162] Apache Tomcat NIO connector denial of service
  5220. | [65161] Apache Tomcat javax.servlet.ServletRequest.getLocale() denial of service
  5221. | [65160] Apache Tomcat HTML Manager interface cross-site scripting
  5222. | [65159] Apache Tomcat ServletContect security bypass
  5223. | [65050] Apache CouchDB web-based administration UI cross-site scripting
  5224. | [64773] Oracle HTTP Server Apache Plugin unauthorized access
  5225. | [64473] Apache Subversion blame -g denial of service
  5226. | [64472] Apache Subversion walk() denial of service
  5227. | [64407] Apache Axis2 CVE-2010-0219 code execution
  5228. | [63926] Apache Archiva password privilege escalation
  5229. | [63785] Apache CouchDB LD_LIBRARY_PATH privilege escalation
  5230. | [63493] Apache Archiva credentials cross-site request forgery
  5231. | [63477] Apache Tomcat HttpOnly session hijacking
  5232. | [63422] Apache Tomcat sessionsList.jsp cross-site scripting
  5233. | [63303] Apache mod_fcgid module fcgid_header_bucket_read() buffer overflow
  5234. | [62959] Apache Shiro filters security bypass
  5235. | [62790] Apache Perl cgi module denial of service
  5236. | [62576] Apache Qpid exchange denial of service
  5237. | [62575] Apache Qpid AMQP denial of service
  5238. | [62354] Apache Qpid SSL denial of service
  5239. | [62235] Apache APR-util apr_brigade_split_line() denial of service
  5240. | [62181] Apache XML-RPC SAX Parser information disclosure
  5241. | [61721] Apache Traffic Server cache poisoning
  5242. | [61202] Apache Derby BUILTIN authentication functionality information disclosure
  5243. | [61186] Apache CouchDB Futon cross-site request forgery
  5244. | [61169] Apache CXF DTD denial of service
  5245. | [61070] Apache Jackrabbit search.jsp SQL injection
  5246. | [61006] Apache SLMS Quoting cross-site request forgery
  5247. | [60962] Apache Tomcat time cross-site scripting
  5248. | [60883] Apache mod_proxy_http information disclosure
  5249. | [60671] Apache HTTP Server mod_cache and mod_dav denial of service
  5250. | [60264] Apache Tomcat Transfer-Encoding denial of service
  5251. | [59746] Apache Axis2 axis2/axis2-admin page session hijacking
  5252. | [59588] Apache Axis2/Java XML DTD (Document Type Declaration) data denial of service
  5253. | [59413] Apache mod_proxy_http timeout information disclosure
  5254. | [59058] Apache MyFaces unencrypted view state cross-site scripting
  5255. | [58827] Apache Axis2 xsd file include
  5256. | [58790] Apache Axis2 modules cross-site scripting
  5257. | [58299] Apache ActiveMQ queueBrowse cross-site scripting
  5258. | [58169] Apache Tomcat Web Application Manager / Host Manager cross-site request forgery
  5259. | [58056] Apache ActiveMQ .jsp source code disclosure
  5260. | [58055] Apache Tomcat realm name information disclosure
  5261. | [58046] Apache HTTP Server mod_auth_shadow security bypass
  5262. | [57841] Apache Open For Business Project (OFBiz) subject cross-site scripting
  5263. | [57840] Apache Open For Business Project (OFBiz) multiple parameters cross-site scripting
  5264. | [57429] Apache CouchDB algorithms information disclosure
  5265. | [57398] Apache ActiveMQ Web console cross-site request forgery
  5266. | [57397] Apache ActiveMQ createDestination.action cross-site scripting
  5267. | [56653] Apache HTTP Server DNS spoofing
  5268. | [56652] Apache HTTP Server DNS cross-site scripting
  5269. | [56625] Apache HTTP Server request header information disclosure
  5270. | [56624] Apache HTTP Server mod_isapi orphaned callback pointer code execution
  5271. | [56623] Apache HTTP Server mod_proxy_ajp denial of service
  5272. | [55941] mod_proxy module for Apache ap_proxy_send_fb() buffer overflow
  5273. | [55857] Apache Tomcat WAR files directory traversal
  5274. | [55856] Apache Tomcat autoDeploy attribute security bypass
  5275. | [55855] Apache Tomcat WAR directory traversal
  5276. | [55210] Intuit component for Joomla! Apache information disclosure
  5277. | [54533] Apache Tomcat 404 error page cross-site scripting
  5278. | [54182] Apache Tomcat admin default password
  5279. | [53878] Apache Solr Search (solr) extension for TYPO3 unspecified cross-site scripting
  5280. | [53666] Apache HTTP Server Solaris pollset support denial of service
  5281. | [53650] Apache HTTP Server HTTP basic-auth module security bypass
  5282. | [53124] mod_proxy_ftp module for Apache HTTP header security bypass
  5283. | [53041] mod_proxy_ftp module for Apache denial of service
  5284. | [52540] Apache Portable Runtime and Apache Portable Utility library multiple buffer overflow
  5285. | [51953] Apache Tomcat Path Disclosure
  5286. | [51952] Apache Tomcat Path Traversal
  5287. | [51951] Apache stronghold-status Information Disclosure
  5288. | [51950] Apache stronghold-info Information Disclosure
  5289. | [51949] Apache PHP Source Code Disclosure
  5290. | [51948] Apache Multiviews Attack
  5291. | [51946] Apache JServ Environment Status Information Disclosure
  5292. | [51945] Apache error_log Information Disclosure
  5293. | [51944] Apache Default Installation Page Pattern Found
  5294. | [51943] Apache AXIS XML Parser echoheaders.jws Sample Web Service Denial of Service
  5295. | [51942] Apache AXIS XML External Entity File Retrieval
  5296. | [51941] Apache AXIS Sample Servlet Information Leak
  5297. | [51940] Apache access_log Information Disclosure
  5298. | [51626] Apache mod_deflate denial of service
  5299. | [51532] mod_proxy module for the Apache HTTP Server stream_reqbody_cl denial of service
  5300. | [51365] Apache Tomcat RequestDispatcher security bypass
  5301. | [51273] Apache HTTP Server Incomplete Request denial of service
  5302. | [51195] Apache Tomcat XML information disclosure
  5303. | [50994] Apache APR-util xml/apr_xml.c denial of service
  5304. | [50993] Apache APR-util apr_brigade_vprintf denial of service
  5305. | [50964] Apache APR-util apr_strmatch_precompile() denial of service
  5306. | [50930] Apache Tomcat j_security_check information disclosure
  5307. | [50928] Apache Tomcat AJP denial of service
  5308. | [50884] Apache HTTP Server XML ENTITY denial of service
  5309. | [50808] Apache HTTP Server AllowOverride privilege escalation
  5310. | [50108] Apache Struts s:a tag and s:url tag cross-site scripting
  5311. | [50059] Apache mod_proxy_ajp information disclosure
  5312. | [49951] Apache Tiles Expression Language (EL) expressions cross-site scripting
  5313. | [49925] Apache Geronimo Web Administrative Console cross-site request forgery
  5314. | [49924] Apache Geronimo console/portal/Server/Monitoring cross-site scripting
  5315. | [49921] Apache ActiveMQ Web interface cross-site scripting
  5316. | [49898] Apache Geronimo Services/Repository directory traversal
  5317. | [49725] Apache Tomcat mod_jk module information disclosure
  5318. | [49715] Apache mod_perl Apache::Status and Apache2::Status modules cross-site scripting
  5319. | [49712] Apache Struts unspecified cross-site scripting
  5320. | [49213] Apache Tomcat cal2.jsp cross-site scripting
  5321. | [48934] Apache Tomcat POST doRead method information disclosure
  5322. | [48211] Apache Tomcat header HTTP request smuggling
  5323. | [48163] libapache2-mod-auth-mysql module for Debian multibyte encoding SQL injection
  5324. | [48110] Apache Jackrabbit search.jsp and swr.jsp cross-site scripting
  5325. | [47709] Apache Roller &quot
  5326. | [47104] Novell Netware ApacheAdmin console security bypass
  5327. | [47086] Apache HTTP Server OS fingerprinting unspecified
  5328. | [46329] Apache Struts FilterDispatcher and DefaultStaticContentLoader class directory traversal
  5329. | [45791] Apache Tomcat RemoteFilterValve security bypass
  5330. | [44435] Oracle WebLogic Apache Connector buffer overflow
  5331. | [44411] Apache Tomcat allowLinking UTF-8 directory traversal
  5332. | [44223] Apache HTTP Server mod_proxy_ftp cross-site scripting
  5333. | [44156] Apache Tomcat RequestDispatcher directory traversal
  5334. | [44155] Apache Tomcat HttpServletResponse.sendError() cross-site scripting
  5335. | [43885] Oracle WebLogic Server Apache Connector buffer overflow
  5336. | [42987] Apache HTTP Server mod_proxy module denial of service
  5337. | [42915] Apache Tomcat JSP files path disclosure
  5338. | [42914] Apache Tomcat MS-DOS path disclosure
  5339. | [42892] Apache Tomcat unspecified unauthorized access
  5340. | [42816] Apache Tomcat Host Manager cross-site scripting
  5341. | [42303] Apache 403 error cross-site scripting
  5342. | [41618] Apache-SSL ExpandCert() authentication bypass
  5343. | [40761] Apache Derby RDBNAM parameter and DatabaseMetaData.getURL information disclosure
  5344. | [40736] Apache Tomcat HTTP/1.1 connector information disclosure
  5345. | [40614] Apache mod_jk2 HTTP Host header buffer overflow
  5346. | [40562] Apache Geronimo init information disclosure
  5347. | [40478] Novell Web Manager webadmin-apache.conf security bypass
  5348. | [40411] Apache Tomcat exception handling information disclosure
  5349. | [40409] Apache Tomcat native (APR based) connector weak security
  5350. | [40403] Apache Tomcat quotes and %5C cookie information disclosure
  5351. | [40388] Sun Java Plug-In org.apache.crimson.tree.XmlDocument security bypass
  5352. | [39893] Apache HTTP Server mod_negotiation HTTP response splitting
  5353. | [39867] Apache HTTP Server mod_negotiation cross-site scripting
  5354. | [39804] Apache Tomcat SingleSignOn information disclosure
  5355. | [39615] Apache HTTP Server mod_proxy_ftp.c UTF-7 cross-site scripting
  5356. | [39612] Apache HTTP Server mod_proxy_balancer buffer overflow
  5357. | [39608] Apache HTTP Server balancer manager cross-site request forgery
  5358. | [39476] Apache mod_proxy_balancer balancer_handler function denial of service
  5359. | [39474] Apache HTTP Server mod_proxy_balancer cross-site scripting
  5360. | [39472] Apache HTTP Server mod_status cross-site scripting
  5361. | [39201] Apache Tomcat JULI logging weak security
  5362. | [39158] Apache HTTP Server Windows SMB shares information disclosure
  5363. | [39001] Apache HTTP Server mod_imap and mod_imagemap module cross-site scripting
  5364. | [38951] Apache::AuthCAS Perl module cookie SQL injection
  5365. | [38800] Apache HTTP Server 413 error page cross-site scripting
  5366. | [38211] Apache Geronimo SQLLoginModule authentication bypass
  5367. | [37243] Apache Tomcat WebDAV directory traversal
  5368. | [37178] RHSA update for Apache HTTP Server mod_status module cross-site scripting not installed
  5369. | [37177] RHSA update for Apache HTTP Server Apache child process denial of service not installed
  5370. | [37119] RHSA update for Apache mod_auth_kerb off-by-one buffer overflow not installed
  5371. | [37100] RHSA update for Apache and IBM HTTP Server Expect header cross-site scripting not installed
  5372. | [36782] Apache Geronimo MEJB unauthorized access
  5373. | [36586] Apache HTTP Server UTF-7 cross-site scripting
  5374. | [36468] Apache Geronimo LoginModule security bypass
  5375. | [36467] Apache Tomcat functions.jsp cross-site scripting
  5376. | [36402] Apache Tomcat calendar cross-site request forgery
  5377. | [36354] Apache HTTP Server mod_proxy module denial of service
  5378. | [36352] Apache HTTP Server ap_proxy_date_canon() denial of service
  5379. | [36336] Apache Derby lock table privilege escalation
  5380. | [36335] Apache Derby schema privilege escalation
  5381. | [36006] Apache Tomcat &quot
  5382. | [36001] Apache Tomcat Host Manager Servlet alias cross-site scripting
  5383. | [35999] Apache Tomcat \&quot
  5384. | [35795] Apache Tomcat CookieExample cross-site scripting
  5385. | [35536] Apache Tomcat SendMailServlet example cross-site scripting
  5386. | [35384] Apache HTTP Server mod_cache module denial of service
  5387. | [35097] Apache HTTP Server mod_status module cross-site scripting
  5388. | [35095] Apache HTTP Server Prefork MPM module denial of service
  5389. | [34984] Apache HTTP Server recall_headers information disclosure
  5390. | [34966] Apache HTTP Server MPM content spoofing
  5391. | [34965] Apache HTTP Server MPM information disclosure
  5392. | [34963] Apache HTTP Server MPM multiple denial of service
  5393. | [34872] Apache MyFaces Tomahawk autoscroll parameter cross-site scripting
  5394. | [34869] Apache Tomcat JSP example Web application cross-site scripting
  5395. | [34868] Apache Tomcat Manager and Host Manager cross-site scripting
  5396. | [34496] Apache Tomcat JK Connector security bypass
  5397. | [34377] Apache Tomcat hello.jsp cross-site scripting
  5398. | [34212] Apache Tomcat SSL configuration security bypass
  5399. | [34210] Apache Tomcat Accept-Language cross-site scripting
  5400. | [34209] Apache Tomcat calendar application cross-site scripting
  5401. | [34207] Apache Tomcat implicit-objects.jsp cross-site scripting
  5402. | [34167] Apache Axis WSDL file path disclosure
  5403. | [34068] Apache Tomcat AJP connector information disclosure
  5404. | [33584] Apache HTTP Server suEXEC privilege escalation
  5405. | [32988] Apache Tomcat proxy module directory traversal
  5406. | [32794] Apache Tomcat JK Web Server Connector map_uri_to_worker() buffer overflow
  5407. | [32708] Debian Apache tty privilege escalation
  5408. | [32441] ApacheStats extract() PHP call unspecified
  5409. | [32128] Apache Tomcat default account
  5410. | [31680] Apache Tomcat RequestParamExample cross-site scripting
  5411. | [31649] Apache Tomcat Sample Servlet TroubleShooter detected
  5412. | [31557] BEA WebLogic Server and WebLogic Express Apache proxy plug-in denial of service
  5413. | [31236] Apache HTTP Server htpasswd.c strcpy buffer overflow
  5414. | [30456] Apache mod_auth_kerb off-by-one buffer overflow
  5415. | [29550] Apache mod_tcl set_var() format string
  5416. | [28620] Apache and IBM HTTP Server Expect header cross-site scripting
  5417. | [28357] Apache HTTP Server mod_alias script source information disclosure
  5418. | [28063] Apache mod_rewrite off-by-one buffer overflow
  5419. | [27902] Apache Tomcat URL information disclosure
  5420. | [26786] Apache James SMTP server denial of service
  5421. | [25680] libapache2 /tmp/svn file upload
  5422. | [25614] Apache Struts lookupMap cross-site scripting
  5423. | [25613] Apache Struts ActionForm denial of service
  5424. | [25612] Apache Struts isCancelled() security bypass
  5425. | [24965] Apache mod_python FileSession command execution
  5426. | [24716] Apache James spooler memory leak denial of service
  5427. | [24159] Apache Geronimo Web-Access-Log Viewer cross-site scripting
  5428. | [24158] Apache Geronimo jsp-examples cross-site scripting
  5429. | [24030] Apache auth_ldap module multiple format strings
  5430. | [24008] Apache mod_ssl custom error message denial of service
  5431. | [24003] Apache mod_auth_pgsql module multiple syslog format strings
  5432. | [23612] Apache mod_imap referer field cross-site scripting
  5433. | [23173] Apache Struts error message cross-site scripting
  5434. | [22942] Apache Tomcat directory listing denial of service
  5435. | [22858] Apache Multi-Processing Module code allows denial of service
  5436. | [22602] RHSA-2005:582 updates for Apache httpd not installed
  5437. | [22520] Apache mod-auth-shadow &quot
  5438. | [22466] ApacheTop symlink
  5439. | [22109] Apache HTTP Server ssl_engine_kernel client certificate validation
  5440. | [22006] Apache HTTP Server byte-range filter denial of service
  5441. | [21567] Apache mod_ssl off-by-one buffer overflow
  5442. | [21195] Apache HTTP Server header HTTP request smuggling
  5443. | [20383] Apache HTTP Server htdigest buffer overflow
  5444. | [19681] Apache Tomcat AJP12 request denial of service
  5445. | [18993] Apache HTTP server check_forensic symlink attack
  5446. | [18790] Apache Tomcat Manager cross-site scripting
  5447. | [18349] Apache HTTP server Apple HFS+ filesystem obtain information
  5448. | [18348] Apache HTTP server Apple HFS+ filesystem .DS_Store and .ht file disclosure
  5449. | [18347] Apache HTTP server Apple Mac OS X Server mod_digest_apple module could allow an attacker to replay responses
  5450. | [17961] Apache Web server ServerTokens has not been set
  5451. | [17930] Apache HTTP Server HTTP GET request denial of service
  5452. | [17785] Apache mod_include module buffer overflow
  5453. | [17671] Apache HTTP Server SSLCipherSuite bypass restrictions
  5454. | [17473] Apache HTTP Server Satisfy directive allows access to resources
  5455. | [17413] Apache htpasswd buffer overflow
  5456. | [17384] Apache HTTP Server environment variable configuration file buffer overflow
  5457. | [17382] Apache HTTP Server IPv6 apr_util denial of service
  5458. | [17366] Apache HTTP Server mod_dav module LOCK denial of service
  5459. | [17273] Apache HTTP Server speculative mode denial of service
  5460. | [17200] Apache HTTP Server mod_ssl denial of service
  5461. | [16890] Apache HTTP Server server-info request has been detected
  5462. | [16889] Apache HTTP Server server-status request has been detected
  5463. | [16705] Apache mod_ssl format string attack
  5464. | [16524] Apache HTTP Server ap_get_mime_headers_core denial of service
  5465. | [16387] Apache HTTP Server mod_proxy Content-Length buffer overflow
  5466. | [16230] Apache HTTP Server PHP denial of service
  5467. | [16214] Apache mod_ssl ssl_util_uuencode_binary buffer overflow
  5468. | [15958] Apache HTTP Server authentication modules memory corruption
  5469. | [15547] Apache HTTP Server mod_disk_cache local information disclosure
  5470. | [15540] Apache HTTP Server socket starvation denial of service
  5471. | [15467] Novell GroupWise WebAccess using Apache Web server allows viewing of files on the server
  5472. | [15422] Apache HTTP Server mod_access information disclosure
  5473. | [15419] Apache HTTP Server mod_ssl plain HTTP request denial of service
  5474. | [15293] Apache for Cygwin &quot
  5475. | [15065] Apache-SSL has a default password
  5476. | [15041] Apache HTTP Server mod_digest module could allow an attacker to replay responses
  5477. | [15015] Apache httpd server httpd.conf could allow a local user to bypass restrictions
  5478. | [14751] Apache Mod_python output filter information disclosure
  5479. | [14125] Apache HTTP Server mod_userdir module information disclosure
  5480. | [14075] Apache HTTP Server mod_php file descriptor leak
  5481. | [13703] Apache HTTP Server account
  5482. | [13689] Apache HTTP Server configuration allows symlinks
  5483. | [13688] Apache HTTP Server configuration allows SSI
  5484. | [13687] Apache HTTP Server Server: header value
  5485. | [13685] Apache HTTP Server ServerTokens value
  5486. | [13684] Apache HTTP Server ServerSignature value
  5487. | [13672] Apache HTTP Server config allows directory autoindexing
  5488. | [13671] Apache HTTP Server default content
  5489. | [13670] Apache HTTP Server config file directive references outside content root
  5490. | [13668] Apache HTTP Server httpd not running in chroot environment
  5491. | [13666] Apache HTTP Server CGI directory contains possible command interpreter or compiler
  5492. | [13664] Apache HTTP Server config file contains ScriptAlias entry
  5493. | [13663] Apache HTTP Server CGI support modules loaded
  5494. | [13661] Apache HTTP Server config file contains AddHandler entry
  5495. | [13660] Apache HTTP Server 500 error page not CGI script
  5496. | [13659] Apache HTTP Server 413 error page not CGI script
  5497. | [13658] Apache HTTP Server 403 error page not CGI script
  5498. | [13657] Apache HTTP Server 401 error page not CGI script
  5499. | [13552] Apache HTTP Server mod_cgid module information disclosure
  5500. | [13550] Apache GET request directory traversal
  5501. | [13516] Apache Cocoon XMLForm and JXForm could allow execution of code
  5502. | [13499] Apache Cocoon directory traversal allows downloading of boot.ini file
  5503. | [13429] Apache Tomcat non-HTTP request denial of service
  5504. | [13400] Apache HTTP server mod_alias and mod_rewrite buffer overflow
  5505. | [13295] Apache weak password encryption
  5506. | [13254] Apache Tomcat .jsp cross-site scripting
  5507. | [13125] Apache::Gallery Inline::C could allow arbitrary code execution
  5508. | [13086] Apache Jakarta Tomcat mod_jk format string allows remote access
  5509. | [12681] Apache HTTP Server mod_proxy could allow mail relaying
  5510. | [12662] Apache HTTP Server rotatelogs denial of service
  5511. | [12554] Apache Tomcat stores password in plain text
  5512. | [12553] Apache HTTP Server redirects and subrequests denial of service
  5513. | [12552] Apache HTTP Server FTP proxy server denial of service
  5514. | [12551] Apache HTTP Server prefork MPM denial of service
  5515. | [12550] Apache HTTP Server weaker than expected encryption
  5516. | [12549] Apache HTTP Server type-map file denial of service
  5517. | [12206] Apache Tomcat /opt/tomcat directory insecure permissions
  5518. | [12102] Apache Jakarta Tomcat MS-DOS device name request denial of service
  5519. | [12091] Apache HTTP Server apr_password_validate denial of service
  5520. | [12090] Apache HTTP Server apr_psprintf code execution
  5521. | [11804] Apache HTTP Server mod_access_referer denial of service
  5522. | [11750] Apache HTTP Server could leak sensitive file descriptors
  5523. | [11730] Apache HTTP Server error log and access log terminal escape sequence injection
  5524. | [11703] Apache long slash path allows directory listing
  5525. | [11695] Apache HTTP Server LF (Line Feed) denial of service
  5526. | [11694] Apache HTTP Server filestat.c denial of service
  5527. | [11438] Apache HTTP Server MIME message boundaries information disclosure
  5528. | [11412] Apache HTTP Server error log terminal escape sequence injection
  5529. | [11196] Apache Tomcat examples and ROOT Web applications cross-site scripting
  5530. | [11195] Apache Tomcat web.xml could be used to read files
  5531. | [11194] Apache Tomcat URL appended with a null character could list directories
  5532. | [11139] Apache HTTP Server mass virtual hosting with mod_rewrite or mod_vhost_alias could allow an attacker to obtain files
  5533. | [11126] Apache HTTP Server illegal character file disclosure
  5534. | [11125] Apache HTTP Server DOS device name HTTP POST code execution
  5535. | [11124] Apache HTTP Server DOS device name denial of service
  5536. | [11088] Apache HTTP Server mod_vhost_alias CGI source disclosure
  5537. | [10938] Apache HTTP Server printenv test CGI cross-site scripting
  5538. | [10771] Apache Tomcat mod_jk module multiple HTTP GET request buffer overflow
  5539. | [10575] Apache mod_php module could allow an attacker to take over the httpd process
  5540. | [10499] Apache HTTP Server WebDAV HTTP POST view source
  5541. | [10457] Apache HTTP Server mod_ssl &quot
  5542. | [10415] Apache HTTP Server htdigest insecure system() call could allow command execution
  5543. | [10414] Apache HTTP Server htdigest multiple buffer overflows
  5544. | [10413] Apache HTTP Server htdigest temporary file race condition
  5545. | [10412] Apache HTTP Server htpasswd temporary file race condition
  5546. | [10376] Apache Tomcat invoker servlet used in conjunction with the default servlet reveals source code
  5547. | [10348] Apache Tomcat HTTP GET request DOS device reference could cause a denial of service
  5548. | [10281] Apache HTTP Server ab.c ApacheBench long response buffer overflow
  5549. | [10280] Apache HTTP Server shared memory scorecard overwrite
  5550. | [10263] Apache Tomcat mod_jk or mod_jserv connector directory disclosure
  5551. | [10241] Apache HTTP Server Host: header cross-site scripting
  5552. | [10230] Slapper worm variants A, B, and C target OpenSSL/Apache systems
  5553. | [10208] Apache HTTP Server mod_dav denial of service
  5554. | [10206] HP VVOS Apache mod_ssl denial of service
  5555. | [10200] Apache HTTP Server stderr denial of service
  5556. | [10175] Apache Tomcat org.apache.catalina.servlets.DefaultServlet reveals source code
  5557. | [10169] Slapper worm variant (Slapper.C) targets OpenSSL/Apache systems
  5558. | [10154] Slapper worm variant (Slapper.B) targets OpenSSL/Apache systems
  5559. | [10098] Slapper worm targets OpenSSL/Apache systems
  5560. | [9876] Apache HTTP Server cgi/cgid request could disclose the path to a requested script
  5561. | [9875] Apache HTTP Server .var file request could disclose installation path
  5562. | [9863] Apache Tomcat web.xml file could allow a remote attacker to bypass restrictions
  5563. | [9808] Apache HTTP Server non-Unix version URL encoded directory traversal
  5564. | [9623] Apache HTTP Server ap_log_rerror() path disclosure
  5565. | [9520] Apache Tomcat /servlet/ mapping cross-site scripting
  5566. | [9415] Apache HTTP Server mod_ssl .htaccess off-by-one buffer overflow
  5567. | [9396] Apache Tomcat null character to threads denial of service
  5568. | [9394] Apache Tomcat HTTP request for LPT9 reveals Web root path
  5569. | [9249] Apache HTTP Server chunked encoding heap buffer overflow
  5570. | [9208] Apache Tomcat sample file requests could reveal directory listing and path to Web root directory
  5571. | [8932] Apache Tomcat example class information disclosure
  5572. | [8633] Apache HTTP Server with mod_rewrite could allow an attacker to bypass directives
  5573. | [8629] Apache HTTP Server double-reverse DNS lookup spoofing
  5574. | [8589] Apache HTTP Server for Windows DOS batch file remote command execution
  5575. | [8457] Oracle9i Application Server Apache PL/SQL HTTP Location header buffer overflow
  5576. | [8455] Oracle9i Application Server default installation could allow an attacker to access certain Apache Services
  5577. | [8400] Apache HTTP Server mod_frontpage buffer overflows
  5578. | [8326] Apache HTTP Server multiple MIME headers (sioux) denial of service
  5579. | [8308] Apache &quot
  5580. | [8275] Apache HTTP Server with Multiviews enabled could disclose directory contents
  5581. | [8119] Apache and PHP OPTIONS request reveals &quot
  5582. | [8054] Apache is running on the system
  5583. | [8029] Mandrake Linux default Apache configuration could allow an attacker to browse files and directories
  5584. | [8027] Mandrake Linux default Apache configuration has remote management interface enabled
  5585. | [8026] Mandrake Linux Apache sample programs could disclose sensitive information about the server
  5586. | [7836] Apache HTTP Server log directory denial of service
  5587. | [7815] Apache for Windows &quot
  5588. | [7810] Apache HTTP request could result in unexpected behavior
  5589. | [7599] Apache Tomcat reveals installation path
  5590. | [7494] Apache &quot
  5591. | [7419] Apache Web Server could allow remote attackers to overwrite .log files
  5592. | [7363] Apache Web Server hidden HTTP requests
  5593. | [7249] Apache mod_proxy denial of service
  5594. | [7129] Linux with Apache Web server could allow an attacker to determine if a specified username exists
  5595. | [7103] Apple Mac OS X used with Apache Web server could disclose directory contents
  5596. | [7059] Apache &quot
  5597. | [7057] Apache &quot
  5598. | [7056] Apache &quot
  5599. | [7055] Apache &quot
  5600. | [7054] Apache &quot
  5601. | [6997] Apache Jakarta Tomcat error message may reveal information
  5602. | [6971] Apache Jakarta Tomcat may reveal JSP source code with missing HTTP protocol specification
  5603. | [6970] Apache crafted HTTP request could reveal the internal IP address
  5604. | [6921] Apache long slash path allows directory listing
  5605. | [6687] Apple Mac OS X used with Apache Web server could allow arbitrary file disclosure
  5606. | [6527] Apache Web Server for Windows and OS2 denial of service
  5607. | [6316] Apache Jakarta Tomcat may reveal JSP source code
  5608. | [6305] Apache Jakarta Tomcat directory traversal
  5609. | [5926] Linux Apache symbolic link
  5610. | [5659] Apache Web server discloses files when used with php script
  5611. | [5310] Apache mod_rewrite allows attacker to view arbitrary files
  5612. | [5204] Apache WebDAV directory listings
  5613. | [5197] Apache Web server reveals CGI script source code
  5614. | [5160] Apache Jakarta Tomcat default installation
  5615. | [5099] Trustix Secure Linux installs Apache with world writable access
  5616. | [4968] Apache Jakarta Tomcat snoop servlet gives out information which could be used in attack
  5617. | [4967] Apache Jakarta Tomcat 404 error reveals the pathname of the requested file
  5618. | [4931] Apache source.asp example file allows users to write to files
  5619. | [4575] IBM HTTP Server running Apache allows users to directory listing and file retrieval
  5620. | [4205] Apache Jakarta Tomcat delivers file contents
  5621. | [2084] Apache on Debian by default serves the /usr/doc directory
  5622. | [1630] MessageMedia UnityMail and Apache Web server MIME header flood denial of service
  5623. | [697] Apache HTTP server beck exploit
  5624. | [331] Apache cookies buffer overflow
  5625. |
  5626. | Exploit-DB - https://www.exploit-db.com:
  5627. | [31130] Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability
  5628. | [31052] Apache <= 2.2.6 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
  5629. | [30901] Apache HTTP Server 2.2.6 Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
  5630. | [30835] Apache HTTP Server <= 2.2.4 413 Error HTTP Request Method Cross-Site Scripting Weakness
  5631. | [30563] Apache Tomcat <= 5.5.15 Cal2.JSP Cross-Site Scripting Vulnerability
  5632. | [30496] Apache Tomcat <= 6.0.13 Cookie Handling Quote Delimiter Session ID Disclosure
  5633. | [30495] Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability
  5634. | [30191] Apache MyFaces Tomahawk JSF Framework 1.1.5 Autoscroll Parameter Cross Site Scripting Vulnerability
  5635. | [30189] Apache Tomcat <= 6.0.13 JSP Example Web Applications Cross Site Scripting Vulnerability
  5636. | [30052] Apache Tomcat 6.0.10 Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
  5637. | [29930] Apache AXIS 1.0 Non-Existent WSDL Path Information Disclosure Vulnerability
  5638. | [29859] Apache Roller OGNL Injection
  5639. | [29739] Apache HTTP Server Tomcat 5.x/6.0.x Directory Traversal Vulnerability
  5640. | [29435] Apache Tomcat 5.5.25 - CSRF Vulnerabilities
  5641. | [29316] Apache + PHP 5.x - Remote Code Execution (Multithreaded Scanner) (2)
  5642. | [29290] Apache / PHP 5.x Remote Code Execution Exploit
  5643. | [28713] Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object RCE
  5644. | [28424] Apache 2.x HTTP Server Arbitrary HTTP Request Headers Security Weakness
  5645. | [28365] Apache 2.2.2 CGI Script Source Code Information Disclosure Vulnerability
  5646. | [28254] Apache Tomcat 5 Information Disclosure Vulnerability
  5647. | [27915] Apache James 2.2 SMTP Denial of Service Vulnerability
  5648. | [27397] Apache suEXEC Privilege Elevation / Information Disclosure
  5649. | [27135] Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
  5650. | [27096] Apache Geronimo 1.0 Error Page XSS
  5651. | [27095] Apache Tomcat / Geronimo 1.0 Sample Script cal2.jsp time Parameter XSS
  5652. | [26710] Apache CXF prior to 2.5.10, 2.6.7 and 2.7.4 - Denial of Service
  5653. | [26542] Apache Struts 1.2.7 Error Response Cross-Site Scripting Vulnerability
  5654. | [25986] Plesk Apache Zeroday Remote Exploit
  5655. | [25980] Apache Struts includeParams Remote Code Execution
  5656. | [25625] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (2)
  5657. | [25624] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (1)
  5658. | [24874] Apache Struts ParametersInterceptor Remote Code Execution
  5659. | [24744] Apache Rave 0.11 - 0.20 - User Information Disclosure
  5660. | [24694] Apache 1.3.x mod_include Local Buffer Overflow Vulnerability
  5661. | [24590] Apache 2.0.x mod_ssl Remote Denial of Service Vulnerability
  5662. | [23751] Apache Cygwin 1.3.x/2.0.x Directory Traversal Vulnerability
  5663. | [23581] Apache 2.0.4x mod_perl Module File Descriptor Leakage Vulnerability
  5664. | [23482] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (2)
  5665. | [23481] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (1)
  5666. | [23296] Red Hat Apache 2.0.40 Directory Index Default Configuration Error
  5667. | [23282] apache cocoon 2.14/2.2 - Directory Traversal vulnerability
  5668. | [23245] Apache Tomcat 4.0.x Non-HTTP Request Denial of Service Vulnerability
  5669. | [23119] Apache::Gallery 0.4/0.5/0.6 Insecure Local File Storage Privilege Escalation Vulnerability
  5670. | [22505] Apache Mod_Access_Referer 1.0.2 NULL Pointer Dereference Denial of Service Vulnerability
  5671. | [22205] Apache Tomcat 3.x Null Byte Directory/File Disclosure Vulnerability
  5672. | [22191] Apache Web Server 2.0.x MS-DOS Device Name Denial of Service Vulnerability
  5673. | [22068] Apache 1.3.x,Tomcat 4.0.x/4.1.x Mod_JK Chunked Encoding Denial of Service Vulnerability
  5674. | [21885] Apache 1.3/2.0.x Server Side Include Cross Site Scripting Vulnerability
  5675. | [21882] Apache Tomcat 3.2 Directory Disclosure Vulnerability
  5676. | [21854] Apache 2.0.39/40 Oversized STDERR Buffer Denial of Service Vulnerability
  5677. | [21853] Apache Tomcat 3/4 DefaultServlet File Disclosure Vulnerability
  5678. | [21734] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
  5679. | [21719] Apache 2.0 Path Disclosure Vulnerability
  5680. | [21697] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
  5681. | [21605] Apache Tomcat 4.0.3 DoS Device Name Cross Site Scripting Vulnerability
  5682. | [21604] Apache Tomcat 4.0.3 Servlet Mapping Cross Site Scripting Vulnerability
  5683. | [21560] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (2)
  5684. | [21559] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (1)
  5685. | [21534] Apache Tomcat 3/4 JSP Engine Denial of Service Vulnerability
  5686. | [21492] Apache Tomcat 3.2.3/3.2.4 RealPath.JSP Malformed Request Information Disclosure
  5687. | [21491] Apache Tomcat 3.2.3/3.2.4 Example Files Web Root Path Disclosure
  5688. | [21490] Apache Tomcat 3.2.3/3.2.4 Source.JSP Malformed Request Information Disclosure
  5689. | [21412] Apache Tomcat 4.0/4.1 Servlet Path Disclosure Vulnerability
  5690. | [21350] Apache Win32 1.3.x/2.0.x Batch File Remote Command Execution Vulnerability
  5691. | [21204] Apache 1.3.20 Win32 PHP.EXE Remote File Disclosure Vulnerability
  5692. | [21112] Red Hat Linux 7.0 Apache Remote Username Enumeration Vulnerability
  5693. | [21067] Apache 1.0/1.2/1.3 Server Address Disclosure Vulnerability
  5694. | [21002] Apache 1.3 Possible Directory Index Disclosure Vulnerability
  5695. | [20911] Apache 1.3.14 Mac File Protection Bypass Vulnerability
  5696. | [20716] apache tomcat 3.0 - Directory Traversal vulnerability
  5697. | [20695] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (4)
  5698. | [20694] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (3)
  5699. | [20693] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (2)
  5700. | [20692] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (1)
  5701. | [20595] NCSA 1.3/1.4.x/1.5,Apache httpd 0.8.11/0.8.14 ScriptAlias Source Retrieval Vulnerability
  5702. | [20558] Apache 1.2 Web Server DoS Vulnerability
  5703. | [20466] Apache 1.3 Web Server with Php 3 File Disclosure Vulnerability
  5704. | [20435] Apache 0.8.x/1.0.x,NCSA httpd 1.x test-cgi Directory Listing Vulnerability
  5705. | [20272] Apache 1.2.5/1.3.1,UnityMail 2.0 MIME Header DoS Vulnerability
  5706. | [20210] Apache 1.3.12 WebDAV Directory Listings Vulnerability
  5707. | [20131] Apache Tomcat 3.1 Path Revealing Vulnerability
  5708. | [19975] Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 Root Directory Access Vulnerability
  5709. | [19828] Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
  5710. | [19536] Apache <= 1.1,NCSA httpd <= 1.5.2,Netscape Server 1.12/1.1/2.0 a nph-test-cgi Vulnerability
  5711. | [19231] PHP apache_request_headers Function Buffer Overflow
  5712. | [18984] Apache Struts <= 2.2.1.1 - Remote Command Execution
  5713. | [18897] Oracle Weblogic Apache Connector POST Request Buffer Overflow
  5714. | [18619] Apache Tomcat Remote Exploit (PUT Request) and Account Scanner
  5715. | [18452] Apache Struts Multiple Persistent Cross-Site Scripting Vulnerabilities
  5716. | [18442] Apache httpOnly Cookie Disclosure
  5717. | [18329] Apache Struts2 <= 2.3.1 - Multiple Vulnerabilities
  5718. | [18221] Apache HTTP Server Denial of Service
  5719. | [17969] Apache mod_proxy Reverse Proxy Exposure Vulnerability PoC
  5720. | [17696] Apache httpd Remote Denial of Service (memory exhaustion)
  5721. | [17691] Apache Struts < 2.2.0 - Remote Command Execution
  5722. | [16798] Apache mod_jk 1.2.20 Buffer Overflow
  5723. | [16782] Apache Win32 Chunked Encoding
  5724. | [16752] Apache module mod_rewrite LDAP protocol Buffer Overflow
  5725. | [16317] Apache Tomcat Manager Application Deployer Authenticated Code Execution
  5726. | [15710] Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
  5727. | [15319] Apache 2.2 (Windows) Local Denial of Service
  5728. | [14617] Apache JackRabbit 2.0.0 webapp XPath Injection
  5729. | [14489] Apache Tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
  5730. | [12721] Apache Axis2 1.4.1 - Local File Inclusion Vulnerability
  5731. | [12689] Authenticated Cross-Site Scripting Vulnerability (XSS) within Apache Axis2 administration console
  5732. | [12343] Apache Tomcat 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 - Information Disclosure Vulnerability
  5733. | [12330] Apache OFBiz - Multiple XSS
  5734. | [12264] Apache OFBiz - FULLADMIN Creator PoC Payload
  5735. | [12263] Apache OFBiz - SQL Remote Execution PoC Payload
  5736. | [11662] Apache Spamassassin Milter Plugin Remote Root Command Execution
  5737. | [11650] Apache 2.2.14 mod_isapi Dangling Pointer Remote SYSTEM Exploit
  5738. | [10811] Joomla.Tutorials GHDB: Apache directory listing Download Vulnerability
  5739. | [10292] Apache Tomcat 3.2.1 - 404 Error Page Cross Site Scripting Vulnerability
  5740. | [9995] Apache Tomcat Form Authentication Username Enumeration Weakness
  5741. | [9994] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
  5742. | [9993] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
  5743. | [8842] Apache mod_dav / svn Remote Denial of Service Exploit
  5744. | [8458] Apache Geronimo <= 2.1.3 - Multiple Directory Traversal Vulnerabilities
  5745. | [7264] Apache Tomcat runtime.getRuntime().exec() Privilege Escalation (win)
  5746. | [6229] apache tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
  5747. | [6100] Apache mod_jk 1.2.19 Remote Buffer Overflow Exploit (win32)
  5748. | [6089] Bea Weblogic Apache Connector Code Exec / Denial of Service Exploit
  5749. | [5386] Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit
  5750. | [5330] Apache 2.0 mod_jk2 2.0.2 - Remote Buffer Overflow Exploit (win32)
  5751. | [4552] Apache Tomcat (webdav) Remote File Disclosure Exploit (ssl support)
  5752. | [4530] Apache Tomcat (webdav) Remote File Disclosure Exploit
  5753. | [4162] Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)
  5754. | [4093] Apache mod_jk 1.2.19/1.2.20 Remote Buffer Overflow Exploit
  5755. | [3996] Apache 2.0.58 mod_rewrite Remote Overflow Exploit (win2k3)
  5756. | [3680] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
  5757. | [3384] Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit
  5758. | [2237] Apache < 1.3.37, 2.0.59, 2.2.3 (mod_rewrite) Remote Overflow PoC
  5759. | [2061] Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
  5760. | [1056] Apache <= 2.0.49 Arbitrary Long HTTP Headers Denial of Service
  5761. | [855] Apache <= 2.0.52 HTTP GET request Denial of Service Exploit
  5762. | [764] Apache OpenSSL - Remote Exploit (Multiple Targets) (OpenFuckV2.c)
  5763. | [587] Apache <= 1.3.31 mod_include Local Buffer Overflow Exploit
  5764. | [466] htpasswd Apache 1.3.31 - Local Exploit
  5765. | [371] Apache HTTPd Arbitrary Long HTTP Headers DoS (c version)
  5766. | [360] Apache HTTPd Arbitrary Long HTTP Headers DoS
  5767. | [132] Apache 1.3.x - 2.0.48 - mod_userdir Remote Users Disclosure Exploit
  5768. | [126] Apache mod_gzip (with debug_mode) <= 1.2.26.1a Remote Exploit
  5769. | [67] Apache 1.3.x mod_mylo Remote Code Execution Exploit
  5770. | [38] Apache <= 2.0.45 APR Remote Exploit -Apache-Knacker.pl
  5771. | [34] Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
  5772. | [11] Apache <= 2.0.44 Linux Remote Denial of Service Exploit
  5773. | [9] Apache HTTP Server 2.x Memory Leak Exploit
  5774. |
  5775. | OpenVAS (Nessus) - http://www.openvas.org:
  5776. | [902924] Apache Struts2 Showcase Skill Name Remote Code Execution Vulnerability
  5777. | [902837] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability (Windows)
  5778. | [902830] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
  5779. | [902664] Apache Traffic Server HTTP Host Header Denial of Service Vulnerability
  5780. | [901203] Apache httpd Web Server Range Header Denial of Service Vulnerability
  5781. | [901110] Apache ActiveMQ Source Code Information Disclosure Vulnerability
  5782. | [901105] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
  5783. | [900842] Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux)
  5784. | [900841] Apache 'mod_proxy_ftp' Module Denial Of Service Vulnerability (Linux)
  5785. | [900573] Apache APR-Utils XML Parser Denial of Service Vulnerability
  5786. | [900572] Apache APR-Utils Multiple Denial of Service Vulnerabilities
  5787. | [900571] Apache APR-Utils Version Detection
  5788. | [900499] Apache mod_proxy_ajp Information Disclosure Vulnerability
  5789. | [900496] Apache Tiles Multiple XSS Vulnerability
  5790. | [900493] Apache Tiles Version Detection
  5791. | [900107] Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
  5792. | [900021] Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
  5793. | [880086] CentOS Update for apache CESA-2008:0004-01 centos2 i386
  5794. | [870175] RedHat Update for apache RHSA-2008:0004-01
  5795. | [864591] Fedora Update for apache-poi FEDORA-2012-10835
  5796. | [864383] Fedora Update for apache-commons-compress FEDORA-2012-8428
  5797. | [864280] Fedora Update for apache-commons-compress FEDORA-2012-8465
  5798. | [864250] Fedora Update for apache-poi FEDORA-2012-7683
  5799. | [864249] Fedora Update for apache-poi FEDORA-2012-7686
  5800. | [863993] Fedora Update for apache-commons-daemon FEDORA-2011-10880
  5801. | [863466] Fedora Update for apache-commons-daemon FEDORA-2011-10936
  5802. | [855821] Solaris Update for Apache 1.3 122912-19
  5803. | [855812] Solaris Update for Apache 1.3 122911-19
  5804. | [855737] Solaris Update for Apache 1.3 122911-17
  5805. | [855731] Solaris Update for Apache 1.3 122912-17
  5806. | [855695] Solaris Update for Apache 1.3 122911-16
  5807. | [855645] Solaris Update for Apache 1.3 122912-16
  5808. | [855587] Solaris Update for kernel update and Apache 108529-29
  5809. | [855566] Solaris Update for Apache 116973-07
  5810. | [855531] Solaris Update for Apache 116974-07
  5811. | [855524] Solaris Update for Apache 2 120544-14
  5812. | [855494] Solaris Update for Apache 1.3 122911-15
  5813. | [855478] Solaris Update for Apache Security 114145-11
  5814. | [855472] Solaris Update for Apache Security 113146-12
  5815. | [855179] Solaris Update for Apache 1.3 122912-15
  5816. | [855147] Solaris Update for kernel update  and Apache 108528-29
  5817. | [855077] Solaris Update for Apache 2 120543-14
  5818. | [850196] SuSE Update for apache2 openSUSE-SU-2012:0314-1 (apache2)
  5819. | [850088] SuSE Update for apache2 SUSE-SA:2007:061
  5820. | [850009] SuSE Update for apache2,apache SUSE-SA:2008:021
  5821. | [841209] Ubuntu Update for apache2 USN-1627-1
  5822. | [840900] Ubuntu Update for apache2 USN-1368-1
  5823. | [840798] Ubuntu Update for apache2 USN-1259-1
  5824. | [840734] Ubuntu Update for apache2 USN-1199-1
  5825. | [840542] Ubuntu Update for apache2 vulnerabilities USN-1021-1
  5826. | [840504] Ubuntu Update for apache2 vulnerability USN-990-2
  5827. | [840399] Ubuntu Update for apache2 vulnerabilities USN-908-1
  5828. | [840304] Ubuntu Update for apache2 vulnerabilities USN-575-1
  5829. | [840118] Ubuntu Update for libapache2-mod-perl2 vulnerability USN-488-1
  5830. | [840092] Ubuntu Update for apache2 vulnerabilities USN-499-1
  5831. | [840039] Ubuntu Update for libapache2-mod-python vulnerability USN-430-1
  5832. | [835253] HP-UX Update for Apache Web Server HPSBUX02645
  5833. | [835247] HP-UX Update for Apache-based Web Server HPSBUX02612
  5834. | [835243] HP-UX Update for Apache Running Tomcat Servlet Engine HPSBUX02579
  5835. | [835236] HP-UX Update for Apache with PHP HPSBUX02543
  5836. | [835233] HP-UX Update for Apache-based Web Server HPSBUX02531
  5837. | [835224] HP-UX Update for Apache-based Web Server HPSBUX02465
  5838. | [835200] HP-UX Update for Apache Web Server Suite HPSBUX02431
  5839. | [835190] HP-UX Update for Apache Web Server Suite HPSBUX02401
  5840. | [835188] HP-UX Update for Apache HPSBUX02308
  5841. | [835181] HP-UX Update for Apache With PHP HPSBUX02332
  5842. | [835180] HP-UX Update for Apache with PHP HPSBUX02342
  5843. | [835172] HP-UX Update for Apache HPSBUX02365
  5844. | [835168] HP-UX Update for Apache HPSBUX02313
  5845. | [835148] HP-UX Update for Apache HPSBUX01064
  5846. | [835139] HP-UX Update for Apache with PHP HPSBUX01090
  5847. | [835131] HP-UX Update for Apache HPSBUX00256
  5848. | [835119] HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186
  5849. | [835104] HP-UX Update for Apache HPSBUX00224
  5850. | [835103] HP-UX Update for Apache mod_cgid HPSBUX00301
  5851. | [835101] HP-UX Update for Apache HPSBUX01232
  5852. | [835080] HP-UX Update for Apache HPSBUX02273
  5853. | [835078] HP-UX Update for ApacheStrong HPSBUX00255
  5854. | [835044] HP-UX Update for Apache HPSBUX01019
  5855. | [835040] HP-UX Update for Apache PHP HPSBUX00207
  5856. | [835025] HP-UX Update for Apache HPSBUX00197
  5857. | [835023] HP-UX Update for Apache HPSBUX01022
  5858. | [835022] HP-UX Update for Apache HPSBUX02292
  5859. | [835005] HP-UX Update for Apache HPSBUX02262
  5860. | [831759] Mandriva Update for apache-mod_security MDVSA-2012:182 (apache-mod_security)
  5861. | [831737] Mandriva Update for apache MDVSA-2012:154-1 (apache)
  5862. | [831534] Mandriva Update for apache MDVSA-2012:012 (apache)
  5863. | [831523] Mandriva Update for apache MDVSA-2012:003 (apache)
  5864. | [831491] Mandriva Update for apache MDVSA-2011:168 (apache)
  5865. | [831460] Mandriva Update for apache MDVSA-2011:144 (apache)
  5866. | [831449] Mandriva Update for apache MDVSA-2011:130 (apache)
  5867. | [831357] Mandriva Update for apache MDVSA-2011:057 (apache)
  5868. | [831132] Mandriva Update for apache MDVSA-2010:153 (apache)
  5869. | [831131] Mandriva Update for apache MDVSA-2010:152 (apache)
  5870. | [830989] Mandriva Update for apache-mod_auth_shadow MDVSA-2010:081 (apache-mod_auth_shadow)
  5871. | [830931] Mandriva Update for apache MDVSA-2010:057 (apache)
  5872. | [830926] Mandriva Update for apache MDVSA-2010:053 (apache)
  5873. | [830918] Mandriva Update for apache-mod_security MDVSA-2010:050 (apache-mod_security)
  5874. | [830799] Mandriva Update for apache-conf MDVSA-2009:300-2 (apache-conf)
  5875. | [830797] Mandriva Update for apache-conf MDVSA-2009:300-1 (apache-conf)
  5876. | [830791] Mandriva Update for apache-conf MDVA-2010:011 (apache-conf)
  5877. | [830652] Mandriva Update for apache MDVSA-2008:195 (apache)
  5878. | [830621] Mandriva Update for apache-conf MDVA-2008:129 (apache-conf)
  5879. | [830581] Mandriva Update for apache MDVSA-2008:016 (apache)
  5880. | [830294] Mandriva Update for apache MDKSA-2007:140 (apache)
  5881. | [830196] Mandriva Update for apache MDKSA-2007:235 (apache)
  5882. | [830112] Mandriva Update for apache MDKSA-2007:127 (apache)
  5883. | [830109] Mandriva Update for apache-mod_perl MDKSA-2007:083 (apache-mod_perl)
  5884. | [802425] Apache Struts2 Showcase Arbitrary Java Method Execution vulnerability
  5885. | [802423] Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities
  5886. | [802422] Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
  5887. | [802415] Apache Tomcat Multiple Security Bypass Vulnerabilities (Win)
  5888. | [802385] Apache Tomcat Request Object Security Bypass Vulnerability (Win)
  5889. | [802384] Apache Tomcat Parameter Handling Denial of Service Vulnerability (Win)
  5890. | [802378] Apache Tomcat Hash Collision Denial Of Service Vulnerability
  5891. | [801942] Apache Archiva Multiple Vulnerabilities
  5892. | [801940] Apache Struts2 'XWork' Information Disclosure Vulnerability
  5893. | [801663] Apache Struts2/XWork Remote Command Execution Vulnerability
  5894. | [801521] Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability
  5895. | [801284] Apache Derby Information Disclosure Vulnerability
  5896. | [801203] Apache ActiveMQ Persistent Cross-Site Scripting Vulnerability
  5897. | [800837] Apache 'mod_deflate' Denial Of Service Vulnerability - July09
  5898. | [800827] Apache 'mod_proxy_http.c' Denial Of Service Vulnerability
  5899. | [800680] Apache APR Version Detection
  5900. | [800679] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
  5901. | [800678] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
  5902. | [800677] Apache Roller Version Detection
  5903. | [800279] Apache mod_jk Module Version Detection
  5904. | [800278] Apache Struts Cross Site Scripting Vulnerability
  5905. | [800277] Apache Tomcat mod_jk Information Disclosure Vulnerability
  5906. | [800276] Apache Struts Version Detection
  5907. | [800271] Apache Struts Directory Traversal Vulnerability
  5908. | [800024] Apache Tomcat RemoteFilterValve Security Bypass Vulnerability
  5909. | [103333] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
  5910. | [103293] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
  5911. | [103122] Apache Web Server ETag Header Information Disclosure Weakness
  5912. | [103074] Apache Continuum Cross Site Scripting Vulnerability
  5913. | [103073] Apache Continuum Detection
  5914. | [103053] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
  5915. | [101023] Apache Open For Business Weak Password security check
  5916. | [101020] Apache Open For Business HTML injection vulnerability
  5917. | [101019] Apache Open For Business service detection
  5918. | [100924] Apache Archiva Cross Site Request Forgery Vulnerability
  5919. | [100923] Apache Archiva Detection
  5920. | [100858] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
  5921. | [100814] Apache Axis2 Document Type Declaration Processing Security Vulnerability
  5922. | [100813] Apache Axis2 Detection
  5923. | [100797] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
  5924. | [100795] Apache Derby Detection
  5925. | [100762] Apache CouchDB Cross Site Request Forgery Vulnerability
  5926. | [100725] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
  5927. | [100613] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
  5928. | [100514] Apache Multiple Security Vulnerabilities
  5929. | [100211] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
  5930. | [100172] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
  5931. | [100171] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
  5932. | [100130] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
  5933. | [72626] Debian Security Advisory DSA 2579-1 (apache2)
  5934. | [72612] FreeBSD Ports: apache22
  5935. | [71551] Gentoo Security Advisory GLSA 201206-25 (apache)
  5936. | [71550] Gentoo Security Advisory GLSA 201206-24 (apache tomcat)
  5937. | [71512] FreeBSD Ports: apache
  5938. | [71485] Debian Security Advisory DSA 2506-1 (libapache-mod-security)
  5939. | [71256] Debian Security Advisory DSA 2452-1 (apache2)
  5940. | [71238] Debian Security Advisory DSA 2436-1 (libapache2-mod-fcgid)
  5941. | [70737] FreeBSD Ports: apache
  5942. | [70724] Debian Security Advisory DSA 2405-1 (apache2)
  5943. | [70600] FreeBSD Ports: apache
  5944. | [70253] FreeBSD Ports: apache, apache-event, apache-itk, apache-peruser, apache-worker
  5945. | [70235] Debian Security Advisory DSA 2298-2 (apache2)
  5946. | [70233] Debian Security Advisory DSA 2298-1 (apache2)
  5947. | [69988] Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)
  5948. | [69338] Debian Security Advisory DSA 2202-1 (apache2)
  5949. | [67868] FreeBSD Ports: apache
  5950. | [66816] FreeBSD Ports: apache
  5951. | [66553] Mandriva Security Advisory MDVSA-2009:189-1 (apache-mod_auth_mysql)
  5952. | [66414] Mandriva Security Advisory MDVSA-2009:323 (apache)
  5953. | [66106] SuSE Security Advisory SUSE-SA:2009:050 (apache2,libapr1)
  5954. | [66081] SLES11: Security update for Apache 2
  5955. | [66074] SLES10: Security update for Apache 2
  5956. | [66070] SLES9: Security update for Apache 2
  5957. | [65998] SLES10: Security update for apache2-mod_python
  5958. | [65893] SLES10: Security update for Apache 2
  5959. | [65888] SLES10: Security update for Apache 2
  5960. | [65575] SLES9: Security update for apache2,apache2-prefork,apache2-worker
  5961. | [65510] SLES9: Security update for Apache 2
  5962. | [65472] SLES9: Security update for Apache
  5963. | [65467] SLES9: Security update for Apache
  5964. | [65450] SLES9: Security update for apache2
  5965. | [65390] SLES9: Security update for Apache2
  5966. | [65363] SLES9: Security update for Apache2
  5967. | [65309] SLES9: Security update for Apache and mod_ssl
  5968. | [65296] SLES9: Security update for webdav apache module
  5969. | [65283] SLES9: Security update for Apache2
  5970. | [65249] SLES9: Security update for Apache 2
  5971. | [65230] SLES9: Security update for Apache 2
  5972. | [65228] SLES9: Security update for Apache 2
  5973. | [65212] SLES9: Security update for apache2-mod_python
  5974. | [65209] SLES9: Security update for apache2-worker
  5975. | [65207] SLES9: Security update for Apache 2
  5976. | [65168] SLES9: Security update for apache2-mod_python
  5977. | [65142] SLES9: Security update for Apache2
  5978. | [65136] SLES9: Security update for Apache 2
  5979. | [65132] SLES9: Security update for apache
  5980. | [65131] SLES9: Security update for Apache 2 oes/CORE
  5981. | [65113] SLES9: Security update for apache2
  5982. | [65072] SLES9: Security update for apache and mod_ssl
  5983. | [65017] SLES9: Security update for Apache 2
  5984. | [64950] Mandrake Security Advisory MDVSA-2009:240 (apache)
  5985. | [64783] FreeBSD Ports: apache
  5986. | [64774] Ubuntu USN-802-2 (apache2)
  5987. | [64653] Ubuntu USN-813-2 (apache2)
  5988. | [64559] Debian Security Advisory DSA 1834-2 (apache2)
  5989. | [64532] Mandrake Security Advisory MDVSA-2009:189 (apache-mod_auth_mysql)
  5990. | [64527] Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
  5991. | [64526] Mandrake Security Advisory MDVSA-2009:183 (apache-mod_security)
  5992. | [64500] Mandrake Security Advisory MDVSA-2009:168 (apache)
  5993. | [64443] Ubuntu USN-802-1 (apache2)
  5994. | [64426] Gentoo Security Advisory GLSA 200907-04 (apache)
  5995. | [64423] Debian Security Advisory DSA 1834-1 (apache2)
  5996. | [64391] Mandrake Security Advisory MDVSA-2009:149 (apache)
  5997. | [64377] Mandrake Security Advisory MDVSA-2009:124-1 (apache)
  5998. | [64251] Debian Security Advisory DSA 1816-1 (apache2)
  5999. | [64201] Ubuntu USN-787-1 (apache2)
  6000. | [64140] Mandrake Security Advisory MDVSA-2009:124 (apache)
  6001. | [64136] Mandrake Security Advisory MDVSA-2009:102 (apache)
  6002. | [63565] FreeBSD Ports: apache
  6003. | [63562] Ubuntu USN-731-1 (apache2)
  6004. | [61381] Gentoo Security Advisory GLSA 200807-06 (apache)
  6005. | [61185] FreeBSD Ports: apache
  6006. | [60582] Gentoo Security Advisory GLSA 200803-19 (apache)
  6007. | [60387] Slackware Advisory SSA:2008-045-02 apache
  6008. | [58826] FreeBSD Ports: apache-tomcat
  6009. | [58825] FreeBSD Ports: apache-tomcat
  6010. | [58804] FreeBSD Ports: apache
  6011. | [58745] Gentoo Security Advisory GLSA 200711-06 (apache)
  6012. | [58360] Debian Security Advisory DSA 1312-1 (libapache-mod-jk)
  6013. | [57851] Gentoo Security Advisory GLSA 200608-01 (apache)
  6014. | [57788] Debian Security Advisory DSA 1247-1 (libapache-mod-auth-kerb)
  6015. | [57335] Debian Security Advisory DSA 1167-1 (apache)
  6016. | [57201] Debian Security Advisory DSA 1131-1 (apache)
  6017. | [57200] Debian Security Advisory DSA 1132-1 (apache2)
  6018. | [57168] Slackware Advisory SSA:2006-209-01 Apache httpd
  6019. | [57145] FreeBSD Ports: apache
  6020. | [56731] Slackware Advisory SSA:2006-129-01 Apache httpd
  6021. | [56729] Slackware Advisory SSA:2006-130-01 Apache httpd redux
  6022. | [56246] Gentoo Security Advisory GLSA 200602-03 (Apache)
  6023. | [56212] Debian Security Advisory DSA 952-1 (libapache-auth-ldap)
  6024. | [56115] Debian Security Advisory DSA 935-1 (libapache2-mod-auth-pgsql)
  6025. | [56067] FreeBSD Ports: apache
  6026. | [55803] Slackware Advisory SSA:2005-310-04 apache
  6027. | [55519] Debian Security Advisory DSA 839-1 (apachetop)
  6028. | [55392] Gentoo Security Advisory GLSA 200509-12 (Apache)
  6029. | [55355] FreeBSD Ports: apache
  6030. | [55284] Debian Security Advisory DSA 807-1 (libapache-mod-ssl)
  6031. | [55261] Debian Security Advisory DSA 805-1 (apache2)
  6032. | [55259] Debian Security Advisory DSA 803-1 (apache)
  6033. | [55129] Gentoo Security Advisory GLSA 200508-15 (apache)
  6034. | [54739] Gentoo Security Advisory GLSA 200411-18 (apache)
  6035. | [54724] Gentoo Security Advisory GLSA 200411-03 (apache)
  6036. | [54712] Gentoo Security Advisory GLSA 200410-21 (apache)
  6037. | [54689] Gentoo Security Advisory GLSA 200409-33 (net=www/apache)
  6038. | [54677] Gentoo Security Advisory GLSA 200409-21 (apache)
  6039. | [54610] Gentoo Security Advisory GLSA 200407-03 (Apache)
  6040. | [54601] Gentoo Security Advisory GLSA 200406-16 (Apache)
  6041. | [54590] Gentoo Security Advisory GLSA 200406-05 (Apache)
  6042. | [54582] Gentoo Security Advisory GLSA 200405-22 (Apache)
  6043. | [54529] Gentoo Security Advisory GLSA 200403-04 (Apache)
  6044. | [54499] Gentoo Security Advisory GLSA 200310-04 (Apache)
  6045. | [54498] Gentoo Security Advisory GLSA 200310-03 (Apache)
  6046. | [54439] FreeBSD Ports: apache
  6047. | [53931] Slackware Advisory SSA:2004-133-01 apache
  6048. | [53903] Slackware Advisory SSA:2004-299-01 apache, mod_ssl, php  
  6049. | [53902] Slackware Advisory SSA:2004-305-01 apache+mod_ssl  
  6050. | [53878] Slackware Advisory SSA:2003-308-01 apache security update
  6051. | [53851] Debian Security Advisory DSA 135-1 (libapache-mod-ssl)
  6052. | [53849] Debian Security Advisory DSA 132-1 (apache-ssl)
  6053. | [53848] Debian Security Advisory DSA 131-1 (apache)
  6054. | [53784] Debian Security Advisory DSA 021-1 (apache)
  6055. | [53738] Debian Security Advisory DSA 195-1 (apache-perl)
  6056. | [53737] Debian Security Advisory DSA 188-1 (apache-ssl)
  6057. | [53735] Debian Security Advisory DSA 187-1 (apache)
  6058. | [53703] Debian Security Advisory DSA 532-1 (libapache-mod-ssl)
  6059. | [53577] Debian Security Advisory DSA 120-1 (libapache-mod-ssl, apache-ssl)
  6060. | [53568] Debian Security Advisory DSA 067-1 (apache,apache-ssl)
  6061. | [53519] Debian Security Advisory DSA 689-1 (libapache-mod-python)
  6062. | [53433] Debian Security Advisory DSA 181-1 (libapache-mod-ssl)
  6063. | [53282] Debian Security Advisory DSA 594-1 (apache)
  6064. | [53248] Debian Security Advisory DSA 558-1 (libapache-mod-dav)
  6065. | [53224] Debian Security Advisory DSA 532-2 (libapache-mod-ssl)
  6066. | [53215] Debian Security Advisory DSA 525-1 (apache)
  6067. | [53151] Debian Security Advisory DSA 452-1 (libapache-mod-python)
  6068. | [52529] FreeBSD Ports: apache+ssl
  6069. | [52501] FreeBSD Ports: apache
  6070. | [52461] FreeBSD Ports: apache
  6071. | [52390] FreeBSD Ports: apache
  6072. | [52389] FreeBSD Ports: apache
  6073. | [52388] FreeBSD Ports: apache
  6074. | [52383] FreeBSD Ports: apache
  6075. | [52339] FreeBSD Ports: apache+mod_ssl
  6076. | [52331] FreeBSD Ports: apache
  6077. | [52329] FreeBSD Ports: ru-apache+mod_ssl
  6078. | [52314] FreeBSD Ports: apache
  6079. | [52310] FreeBSD Ports: apache
  6080. | [15588] Detect Apache HTTPS
  6081. | [15555] Apache mod_proxy content-length buffer overflow
  6082. | [15554] Apache mod_include priviledge escalation
  6083. | [14771] Apache <= 1.3.33 htpasswd local overflow
  6084. | [14177] Apache mod_access rule bypass
  6085. | [13644] Apache mod_rootme Backdoor
  6086. | [12293] Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities
  6087. | [12280] Apache Connection Blocking Denial of Service
  6088. | [12239] Apache Error Log Escape Sequence Injection
  6089. | [12123] Apache Tomcat source.jsp malformed request information disclosure
  6090. | [12085] Apache Tomcat servlet/JSP container default files
  6091. | [11438] Apache Tomcat Directory Listing and File disclosure
  6092. | [11204] Apache Tomcat Default Accounts
  6093. | [11092] Apache 2.0.39 Win32 directory traversal
  6094. | [11046] Apache Tomcat TroubleShooter Servlet Installed
  6095. | [11042] Apache Tomcat DOS Device Name XSS
  6096. | [11041] Apache Tomcat /servlet Cross Site Scripting
  6097. | [10938] Apache Remote Command Execution via .bat files
  6098. | [10839] PHP.EXE / Apache Win32 Arbitrary File Reading Vulnerability
  6099. | [10773] MacOS X Finder reveals contents of Apache Web files
  6100. | [10766] Apache UserDir Sensitive Information Disclosure
  6101. | [10756] MacOS X Finder reveals contents of Apache Web directories
  6102. | [10752] Apache Auth Module SQL Insertion Attack
  6103. | [10704] Apache Directory Listing
  6104. | [10678] Apache /server-info accessible
  6105. | [10677] Apache /server-status accessible
  6106. | [10440] Check for Apache Multiple / vulnerability
  6107. |
  6108. | SecurityTracker - https://www.securitytracker.com:
  6109. | [1028865] Apache Struts Bugs Permit Remote Code Execution and URL Redirection Attacks
  6110. | [1028864] Apache Struts Wildcard Matching and Expression Evaluation Bugs Let Remote Users Execute Arbitrary Code
  6111. | [1028824] Apache mod_dav_svn URI Processing Flaw Lets Remote Users Deny Service
  6112. | [1028823] Apache Unspecified Flaw in mod_session_dbd Has Unspecified Impact
  6113. | [1028724] (HP Issues Fix for HP-UX) Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
  6114. | [1028722] (Red Hat Issues Fix for JBoss) Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
  6115. | [1028693] (Red Hat Issues Fix) Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
  6116. | [1028622] Apache Struts 'includeParams' Bugs Permit Remote Command Execution and Cross-Site Scripting Attacks
  6117. | [1028621] Apache Subversion Bugs Let Remote Authenticated Users Execute Arbitrary Commands and Deny Service
  6118. | [1028540] Apache mod_rewrite Input Validation Flaw Lets Remote Users Execute Arbitrary Commands
  6119. | [1028534] Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
  6120. | [1028533] Apache Tomcat Lack of Chunked Transfer Encoding Extension Size Limit Lets Remote Users Deny Service
  6121. | [1028532] Apache Tomcat AsyncListeners Bug May Disclose Information from One Request to Another User
  6122. | [1028515] Apache VCL Input Validation Flaw Lets Remote Authenticated Users Gain Elevated Privileges
  6123. | [1028457] Apache ActiveMQ Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Deny Service, and Obtain Potentially Sensitive Information
  6124. | [1028287] Apache CXF WSS4JInInterceptor Grants Service Access to Remote Users
  6125. | [1028286] Apache CXF WS-Security UsernameToken Processing Flaw Lets Remote Users Bypass Authentication
  6126. | [1028252] Apache Commons FileUpload Unsafe Temporary File Lets Local Users Gain Elevated Privileges
  6127. | [1028207] Apache Input Validation Bugs Permit Cross-Site Scripting Attacks
  6128. | [1027836] Apache Tomcat Connection Processing Bug Lets Remote Users Deny Service
  6129. | [1027834] Apache Tomcat Bug Lets Remote Users Bypass Cross-Site Request Forgery Prevention Filter
  6130. | [1027833] Apache Tomcat Bug Lets Remote Users Bypass Security Constraints
  6131. | [1027729] Apache Tomcat Header Processing Bug Lets Remote Users Deny Service
  6132. | [1027728] Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
  6133. | [1027554] Apache CXF Lets Remote Authenticated Users Execute Unauthorized SOAP Actions
  6134. | [1027508] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
  6135. | [1027421] Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
  6136. | [1027096] Apache Commons Compress BZip2CompressorOutputStream() Sorting Algorithm Lets Remote or Local Users Deny Service
  6137. | [1026932] Apache LD_LIBRARY_PATH Processing Lets Local Users Gain Elevated Privileges
  6138. | [1026928] Apache OFBiz Unspecified Flaw Lets Remote Users Execute Arbitrary Code
  6139. | [1026927] Apache OFBiz Input Validation Flaws Permit Cross-Site Scripting Attacks
  6140. | [1026847] Apache Traffic Server Host Header Processing Flaw Lets Remote Users Deny Service
  6141. | [1026846] Apache Wicket Discloses Hidden Application Files to Remote Users
  6142. | [1026839] Apache Wicket Input Validation Flaw in 'wicket:pageMapName' Parameter Permits Cross-Site Scripting Attacks
  6143. | [1026616] Apache Bugs Let Remote Users Deny Service and Obtain Cookie Data
  6144. | [1026575] Apache Struts ParameterInterceptor() Flaw Lets Remote Users Execute Arbitrary Commands
  6145. | [1026484] Apache Struts Bug Lets Remote Users Overwrite Files and Execute Arbitrary Code
  6146. | [1026477] Apache Tomcat Hash Table Collision Bug Lets Remote Users Deny Service
  6147. | [1026402] Apache Struts Conversion Error Lets Remote Users Inject Arbitrary Commands
  6148. | [1026353] Apache mod_proxy/mod_rewrite Bug Lets Remote Users Access Internal Servers
  6149. | [1026295] Apache Tomcat Lets Untrusted Web Applications Gain Elevated Privileges
  6150. | [1026267] Apache .htaccess File Integer Overflow Lets Local Users Execute Arbitrary Code
  6151. | [1026144] Apache mod_proxy Pattern Matching Bug Lets Remote Users Access Internal Servers
  6152. | [1026095] Apache Tomcat HTTP DIGEST Authentication Weaknesses Let Remote Users Conduct Bypass Attacks
  6153. | [1026054] Apache mod_proxy_ajp HTTP Processing Error Lets Remote Users Deny Service
  6154. | [1025993] Apache Tomcat AJP Protocol Processing Bug Lets Remote Users Bypass Authentication or Obtain Information
  6155. | [1025976] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
  6156. | [1025960] Apache httpd Byterange Filter Processing Error Lets Remote Users Deny Service
  6157. | [1025925] Apache Tomcat Commons Daemon jsvc Lets Local Users Gain Elevated Privileges
  6158. | [1025924] Apache Tomcat XML Validation Flaw Lets Applications Obtain Potentially Sensitive Information
  6159. | [1025788] Apache Tomcat Lets Malicious Applications Obtain Information and Deny Service
  6160. | [1025755] Apache Santuario Buffer Overflow Lets Remote Users Deny Service
  6161. | [1025712] Apache Tomcat Discloses Passwords to Local Users in Certain Cases
  6162. | [1025577] Apache Archiva Input Validation Hole Permits Cross-Site Scripting Attacks
  6163. | [1025576] Apache Archiva Request Validation Flaw Permits Cross-Site Request Forgery Attacks
  6164. | [1025527] Apache APR Library apr_fnmatch() Flaw Lets Remote Users Execute Arbitrary Code
  6165. | [1025303] Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
  6166. | [1025215] Apache Tomcat May Ignore @ServletSecurity Annotation Protections
  6167. | [1025066] Apache Continuum Input Validation Flaw Permits Cross-Site Request Forgery Attacks
  6168. | [1025065] Apache Continuum Input Validation Hole Permits Cross-Site Scripting Attacks
  6169. | [1025027] Apache Tomcat maxHttpHeaderSize Parsing Error Lets Remote Users Deny Service
  6170. | [1025026] Apache Tomcat Manager Input Validation Hole Permits Cross-Site Scripting Attacks
  6171. | [1025025] Apache Tomcat Security Manager Lets Local Users Bypass File Permissions
  6172. | [1024764] Apache Tomcat Manager Input Validation Hole in 'sessionList.jsp' Permits Cross-Site Scripting Attacks
  6173. | [1024417] Apache Traffic Server Insufficient Randomization Lets Remote Users Poison the DNS Cache
  6174. | [1024332] Apache mod_cache and mod_dav Request Processing Flaw Lets Remote Users Deny Service
  6175. | [1024180] Apache Tomcat 'Transfer-Encoding' Header Processing Flaw Lets Remote Users Deny Service and Obtain Potentially Sensitive Information
  6176. | [1024096] Apache mod_proxy_http May Return Results for a Different Request
  6177. | [1023942] Apache mod_proxy_ajp Error Condition Lets Remote Users Deny Service
  6178. | [1023941] Apache ap_read_request() Memory Error May Let Remote Users Access Potentially Sensitive Information
  6179. | [1023778] Apache ActiveMQ Input Validation Flaw Permits Cross-Site Scripting Attacks
  6180. | [1023701] Apache mod_isapi Error Processing Flaw May Let Remote Users Deny Service
  6181. | [1023533] Apache mod_proxy Integer Overflow May Let Remote Users Execute Arbitrary Code
  6182. | [1022988] Apache Solaris Support Code Bug Lets Remote Users Deny Service
  6183. | [1022529] Apache mod_deflate Connection State Bug Lets Remote Users Deny Service
  6184. | [1022509] Apache mod_proxy stream_reqbody_cl() Infinite Loop Lets Remote Users Deny Service
  6185. | [1022296] Apache IncludesNoExec Options Restrictions Can Be Bypass By Local Users
  6186. | [1022264] Apache mod_proxy_ajp Bug May Disclose Another User's Response Data
  6187. | [1022001] Apache Tomcat mod_jk May Disclose Responses to the Wrong User
  6188. | [1021988] mod_perl Input Validation Flaw in Apache::Status and Apache2::Status Permits Cross-Site Scripting Attacks
  6189. | [1021350] NetWare Bug Lets Remote Users Access the ApacheAdmin Console
  6190. | [1020635] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
  6191. | [1020520] Oracle WebLogic Apache Connector Lets Remote Users Execute Arbitrary Code
  6192. | [1020267] Apache mod_proxy Interim Response Process Bug Lets Remote Users Deny Service
  6193. | [1019784] Apache-SSL Certificate Processing Bug May Let Remote Users View Portions of Kernel Memory
  6194. | [1019256] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks
  6195. | [1019194] Apache Input Validation Hole in Mod_AutoIndex When the Character Set is Undefined May Permit Cross-Site Scripting Attacks
  6196. | [1019185] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
  6197. | [1019154] Apache Input Validation Hole in mod_status Permits Cross-Site Scripting Attacks
  6198. | [1019093] Apache Input Validation Hole in mod_imap Permits Cross-Site Scripting Attacks
  6199. | [1019030] Apache Input Validation Hole in Default HTTP 413 Error Page Permits Cross-Site Scripting Attacks
  6200. | [1018633] Apache mod_proxy Bug Lets Remote Users Deny Service
  6201. | [1018304] Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
  6202. | [1018303] Apache HTTPD mod_cache May Let Remote Users Deny Service
  6203. | [1018302] Apache mod_status Input Validation Hole Permits Cross-Site Scripting Attacks
  6204. | [1018269] Apache Tomcat Input Validation Hole in Processing Accept-Language Header Permits Cross-Site Scripting Attacks
  6205. | [1017904] Apache suEXEC Bugs May Let Local Users Gain Elevated Privileges
  6206. | [1017719] Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code
  6207. | [1017062] Apache mod_tcl Format String Bug in set_var() Function May Let Remote Users Execute Arbitrary Code
  6208. | [1016601] Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
  6209. | [1016576] Apache Tomcat Discloses Directory Listings to Remote Users
  6210. | [1015447] Apache mod_ssl Null Pointer Dereference May Let Remote Users Deny Service
  6211. | [1015344] Apache mod_imap Input Validation Flaw in Referer Field Lets Remote Users Conduct Cross-Site Scripting Attacks
  6212. | [1015093] Apache Memory Leak in MPM 'worker.c' Code May Let Remote Users Deny Service
  6213. | [1014996] ApacheTop Unsafe Temporary File May Let Local Users Gain Elevated Privileges
  6214. | [1014833] Apache ssl_hook_Access() Function May Fail to Verify Client Certificates
  6215. | [1014826] Apache Memory Leak in 'byterange filter' Lets Remote Users Deny Service
  6216. | [1014575] Apache mod_ssl Off-by-one Buffer Overflow in Processing CRLs May Let Remote Users Deny Service
  6217. | [1014323] Apache Chunked Transfer-Encoding and Content-Length Processing Lets Remote Users Smuggle HTTP Requests
  6218. | [1013156] Apache mod_python Publisher Handler Discloses Information to Remote Users
  6219. | [1012829] Apache mod_auth_radius radcpy() Integer Overflow Lets Remote Users Deny Service in Certain Cases
  6220. | [1012416] Apache on Apple OS X Lets Remote Users Bypass Apache File Handlers and Directly Access Files
  6221. | [1012415] Apache on Apple HFS+ Filesystems May Disclose '.DS_Store' Files to Remote Users
  6222. | [1012414] Apache mod_digest_apple Lets Remote Users Replay Authentication Credentials
  6223. | [1012083] Apache Web Server Error in Processing Requests With Many Space Characters Lets Remote Users Deny Service
  6224. | [1011783] Apache mod_include Buffer Overflow Lets Local Users Execute Arbitrary Code
  6225. | [1011557] Apache mod_ssl SSLCipherSuite Directive Can By Bypassed in Certain Cases
  6226. | [1011385] Apache Satsify Directive Error May Let Remote Users Access Restricted Resources
  6227. | [1011340] Apache SSL Connection Abort State Error Lets Remote Users Deny Service
  6228. | [1011303] Apache ap_resolve_env() Buffer Overflow in Reading Configuration Files May Let Local Users Gain Elevated Privileges
  6229. | [1011299] Apache IPv6 Address Parsing Flaw May Let Remote Users Deny Service
  6230. | [1011248] Apache mod_dav LOCK Method Error May Let Remote Users Deny Service
  6231. | [1011213] Apache mod_ssl Can Be Crashed By Remote Users When Reverse Proxying SSL Connections
  6232. | [1010674] Apache Can Be Crashed By PHP Code Invoking Nested Remote Sockets
  6233. | [1010599] Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server
  6234. | [1010462] Apache mod_proxy Buffer Overflow May Let Remote Users Execute Arbitrary Code
  6235. | [1010322] Apache mod_ssl Stack Overflow in ssl_util_uuencode_binary() May Let Remote Users Execute Arbitrary Code
  6236. | [1010270] cPanel Apache mod_phpsuexec Options Let Local Users Gain Elevated Privileges
  6237. | [1009934] Apache Web Server Has Buffer Overflow in ebcdic2ascii() on Older Processor Architectures
  6238. | [1009516] Apache mod_survey HTML Report Format Lets Remote Users Conduct Cross-Site Scripting Attacks
  6239. | [1009509] Apache mod_disk_cache Stores Authentication Credentials on Disk
  6240. | [1009495] Apache Web Server Socket Starvation Flaw May Let Remote Users Deny Service
  6241. | [1009417] GroupWise WebAccess With Apache on NetWare Has Configuration Flaw That May Grant Web Access to Remote Users
  6242. | [1009338] Apache mod_access Parsing Flaw May Fail to Enforce Allow/Deny Rules
  6243. | [1009337] Apache mod_ssl Memory Leak Lets Remote Users Crash the Daemon
  6244. | [1009182] Apache for Cygwin '..%5C' Input Validation Flaw Discloses Files to Remote Users
  6245. | [1008973] PHP May Apply Incorrect php_admin_* Settings To Requests for Apache Virtual Hosts
  6246. | [1008967] Apache-SSL 'SSLFakeBasicAuth' Lets Remote Users Forge Client Certificates to Be Authenticated
  6247. | [1008920] Apache mod_digest May Validate Replayed Client Responses
  6248. | [1008828] Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
  6249. | [1008822] Apache mod_perl File Descriptor Leak May Let Local Users Hijack the http and https Services
  6250. | [1008675] mod_auth_shadow Apache Module Authenticates Expired Passwords
  6251. | [1008559] Apache mod_php File Descriptor Leak May Let Local Users Hijack the https Service
  6252. | [1008335] Apache mod_python String Processing Bug Lets Remote Users Crash the Web Server
  6253. | [1008196] Apache 2.x on Windows May Return Unexpected Files For URLs Ending With Certain Characters
  6254. | [1008030] Apache mod_rewrite Contains a Buffer Overflow
  6255. | [1008029] Apache mod_alias Contains a Buffer Overflow
  6256. | [1008028] Apache mod_cgid May Disclose CGI Output to Another Client
  6257. | [1007995] Apache Cocoon Forms May Let Remote Users Execute Arbitrary Java Code on the System
  6258. | [1007993] Apache Cocoon 'view-source' Sample Script Discloses Files to Remote Users
  6259. | [1007823] Apache Web Server mod_cgi Error May Let Malicious CGI Scripts Crash the Web Service
  6260. | [1007664] Apache::Gallery Unsafe Temporary Files May Let Local Users Gain Apache Web Server Privileges
  6261. | [1007557] Apache Web Server Does Not Filter Terminal Escape Sequences From Log Files
  6262. | [1007230] Apache HTTP Server 'rotatelogs' Bug on Win32 and OS/2 May Cause the Logging to Stop
  6263. | [1007146] Apache HTTP Server FTP Proxy Bug May Cause Denial of Service Conditions
  6264. | [1007145] Apache 'accept()' Errors May Cause Denial of Service Conditions
  6265. | [1007144] Apache Web Server 'type-map' File Error Permits Local Denial of Service Attacks
  6266. | [1007143] Apache 2.0 Web Server May Use a Weaker Encryption Implementation Than Specified in Some Cases
  6267. | [1006864] Apache Web Server Can Be Crashed By Remote Users Via mod_dav Flaws and Also Via Basic Authentication
  6268. | [1006709] Apache mod_survey Input Validation Flaw Lets Remote Users Fill Up Disk Space
  6269. | [1006614] Apache mod_ntlm Buffer Overflow and Format String Flaw Let Remote Users Execute Arbitary Code
  6270. | [1006591] Apache mod_access_referer Module Null Pointer Dereference May Faciliate Denial of Service Attacks
  6271. | [1006444] Apache 2.0 Web Server Line Feed Buffer Allocation Flaw Lets Remote Users Deny Service
  6272. | [1006021] Apache Tomcat Server URL Parsing Error May Disclose Otherwise Inaccessible Web Directory Listings and Files to Remote Users
  6273. | [1005963] Apache Web Server 2.x Windows Device Access Flaw Lets Remote Users Crash the Server or Possibly Execute Arbitrary Code
  6274. | [1005962] Apache Web Server Path Parsing Flaw May Allow Remote Users to Execute Code in Certain Configurations
  6275. | [1005848] Apache 'printenv' Script Input Validation Bugs in Older Versions May Let Remote Users Conduct Cross-Site Scripting Attacks
  6276. | [1005765] Apache mod_jk Module Processing Bug When Used With Tomcat May Disclose Information to Remote Users or Crash
  6277. | [1005548] Apache mod_php Module May Allow Local Users to Gain Control of the Web Port
  6278. | [1005499] Apache Web Server (2.0.42) May Disclose CGI Source Code to Remote Users When Used With WebDAV
  6279. | [1005410] Apache Tomcat Java Servlet Engine Can Be Crashed Via Multiple Requests for DOS Device Names
  6280. | [1005351] Apache Web Server (1.3.x) Shared Memory Scoreboard Bug Lets Certain Local Users Issue Signals With Root Privileges
  6281. | [1005331] Apache Web Server (2.x) SSI Server Signature Filtering Hole Lets Remote Users Conduct Cross-Site Scripting Attacks
  6282. | [1005290] Apache Tomcat Java Server Default Servlet Returns JSP Source Code to Remote Users
  6283. | [1005285] Apache Web Server 'mod_dav' Has Null Pointer Bug That May Allow Remote Users to Cause Denial of Service Conditions
  6284. | [1005010] Apache Web Server (2.0) Has Unspecified Flaw That Allows Remote Users to Obtain Sensitive Data and Cause Denial of Service Conditions
  6285. | [1004770] Apache 2.x Web Server ap_log_rerror() Function May Disclose Full Installation Path to Remote Users
  6286. | [1004745] Apache Tomcat Java Server Allows Cross-Site Scripting Attacks
  6287. | [1004636] Apache mod_ssl 'Off-by-One' Bug May Let Local Users Crash the Web Server or Possibly Execute Arbitrary Code
  6288. | [1004602] Apache Tomcat Java Server for Windows Can Be Crashed By Remote Users Sending Malicious Requests to Hang All Available Working Threads
  6289. | [1004586] Apache Tomcat Java Server May Disclose the Installation Path to Remote Users
  6290. | [1004555] Apache Web Server Chunked Encoding Flaw May Let Remote Users Execute Arbitrary Code on the Server
  6291. | [1004209] Apache 'mod_python' Python Language Interpreter Bug in Publisher Handler May Allow Remote Users to Modify Files on the System
  6292. | [1003874] Apache Web Server for Windows Has Batch File Processing Hole That Lets Remote Users Execute Commands on the System
  6293. | [1003767] 'mod_frontpage' Module for Apache Web Server Has Buffer Overlow in 'fpexec.c' That Allows Remote Users to Execute Arbitrary Code on the System with Root Privileges
  6294. | [1003723] Apache-SSL for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
  6295. | [1003664] 'mod_ssl' Security Package for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
  6296. | [1003602] GNUJSP Java Server Pages Implementation Discloses Web Files and Source Code to Remote Users and Bypasses Apache Access Control Restrictions
  6297. | [1003465] PHP for Apache Web Server May Disclose Installation Path Information to Remote Users Making 'OPTIONS' Requests
  6298. | [1003451] Oracle Application Server PL/SQL Module for Apache Has Buffer Overflows That Allow Remote Users to Execute Arbitrary Code and Gain Access to the Server
  6299. | [1003131] Apache Web Server in Virtual Hosting Mode Can Be Crashed By a Local User Removing a Log Directory
  6300. | [1003104] PHP.EXE Windows CGI for Apache Web Server May Let Remote Users View Files on the Server Due to Configuration Error
  6301. | [1003008] Apache 'mod_bf' Module Lets Remote Users Execute Arbitrary Code
  6302. | [1002629] Apache suEXEC Wrapper Fails to Observe Minimum Group ID Security Settings in Certain Situations
  6303. | [1002542] Apache Web Server Virtual Hosting Split-Logfile Function Lets Remote Users Write Log Entries to Arbitrary Files on the System
  6304. | [1002400] Apache mod_gzip Module Has Buffer Overflow That Can Be Exploited By Local Users to Gain Elevated Privileges
  6305. | [1002303] Several 3rd Party Apache Authentication Modules Allow Remote Users to Execute Arbitrary Code to Gain Access to the System or Execute Stored Procedures to Obtain Arbitrary Database Information
  6306. | [1002188] Apache Web Server Discloses Internal IP Addresses to Remote Users in Certain Configurations
  6307. | [1001989] Apache Web Server May Disclose Directory Contents Even If an Index.html File is Present in the Directory
  6308. | [1001719] Apache Web Server on Mac OS X Client Fails to Enforce File and Directory Access Protections, Giving Remote Users Access to Restricted Pages
  6309. | [1001572] Apache Web Server on Microsoft Windows Platforms Allows Remote Users to Crash the Web Server
  6310. | [1001304] Apache Web Server for Windows Lets Remote Users Crash the Web Server Application
  6311. | [1001083] Apache Web Server May Display Directory Index Listings Even if Directory Listings Are Disabled
  6312. |
  6313. | OSVDB - http://www.osvdb.org:
  6314. | [96078] Apache CloudStack Infrastructure Menu Setup Network Multiple Field XSS
  6315. | [96077] Apache CloudStack Global Settings Multiple Field XSS
  6316. | [96076] Apache CloudStack Instances Menu Display Name Field XSS
  6317. | [96075] Apache CloudStack Instances Menu Add Instances Network Name Field XSS
  6318. | [96074] Apache CloudStack Instances Menu Add Instances Review Step Multiple Field XSS
  6319. | [96031] Apache HTTP Server suEXEC Symlink Arbitrary File Access
  6320. | [95888] Apache Archiva Single / Double Quote Character Handling XSS Weakness
  6321. | [95885] Apache Subversion mod_dav_svn Module Crafted HTTP Request Handling Remote DoS
  6322. | [95706] Apache OpenOffice.org (OOo) OOXML Document File XML Element Handling Memory Corruption
  6323. | [95704] Apache OpenOffice.org (OOo) DOC File PLCF Data Handling Memory Corruption
  6324. | [95603] Apache Continuum web/util/GenerateRecipentNotifier.java recipient Parameter XSS
  6325. | [95602] Apache Continuum web/action/notifier/JabberProjectNotifierEditAction-jabberProjectNotifierSave-validation.xml Multiple Parameter XSS
  6326. | [95601] Apache Continuum web/action/notifier/JabberGroupNotifierEditAction-jabberProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
  6327. | [95600] Apache Continuum web/action/ScheduleAction-saveSchedule-validation.xml Multiple Parameter XSS
  6328. | [95599] Apache Continuumweb/action/BuildDefinitionAction-saveBuildDefinition-validation.xml Multiple Parameter XSS
  6329. | [95598] Apache Continuum web/action/AddProjectAction-addProject-validation.xml Multiple Parameter XSS
  6330. | [95597] Apache Continuum web/action/ProjectEditAction-projectSave-validation.xml Multiple Parameter XSS
  6331. | [95596] Apache Continuum web/action/notifier/IrcGroupNotifierEditAction-ircProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
  6332. | [95595] Apache Continuum web/action/notifier/IrcProjectNotifierEditAction-ircProjectNotifierSave-validation.xml Multiple Parameter XSS
  6333. | [95594] Apache Continuum web/action/ProjectGroupAction.java Multiple Parameter XSS
  6334. | [95593] Apache Continuum web/action/AddProjectGroupAction.java Multiple Parameter XSS
  6335. | [95592] Apache Continuum web/action/AddProjectAction.java Multiple Parameter XSS
  6336. | [95523] Apache OFBiz Webtools Application View Log Screen Unspecified XSS
  6337. | [95522] Apache OFBiz Nested Expression Evaluation Arbitrary UEL Function Execution
  6338. | [95521] Apache HTTP Server mod_session_dbd Session Saving Unspecified Issue
  6339. | [95498] Apache HTTP Server mod_dav.c Crafted MERGE Request Remote DoS
  6340. | [95406] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Arbitrary Site Redirect
  6341. | [95405] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Remote Code Execution
  6342. | [95011] Apache CXF XML Parser SOAP Message Handling CPU Resource Exhaustion Remote DoS
  6343. | [94705] Apache Geronimo RMI Classloader Exposure Serialized Object Handling Remote Code Execution
  6344. | [94651] Apache Santuario (XML Security for C++) XML Signature CanonicalizationMethod Parameter Spoofing Weakness
  6345. | [94636] Apache Continuum workingCopy.action userDirectory Traversal Arbitrary File Access
  6346. | [94635] Apache Maven SCM SvnCommandlineUtils Process Listing Local Password Disclosure
  6347. | [94632] Apache Maven Wagon SSH (wagon-ssh) Host Verification Failure MitM Weakness
  6348. | [94625] Apache Santuario (XML Security for C++) XML Signature Reference Crafted XPointer Expression Handling Heap Buffer Overflow
  6349. | [94618] Apache Archiva /archiva/security/useredit.action username Parameter XSS
  6350. | [94617] Apache Archiva /archiva/security/roleedit.action name Parameter XSS
  6351. | [94616] Apache Archiva /archiva/security/userlist!show.action roleName Parameter XSS
  6352. | [94615] Apache Archiva /archiva/deleteArtifact!doDelete.action groupId Parameter XSS
  6353. | [94614] Apache Archiva /archiva/admin/addLegacyArtifactPath!commit.action legacyArtifactPath.path Parameter XSS
  6354. | [94613] Apache Archiva /archiva/admin/addRepository.action Multiple Parameter XSS
  6355. | [94612] Apache Archiva /archiva/admin/editAppearance.action Multiple Parameter XSS
  6356. | [94611] Apache Archiva /archiva/admin/addLegacyArtifactPath.action Multiple Parameter XSS
  6357. | [94610] Apache Archiva /archiva/admin/addNetworkProxy.action Multiple Parameter XSS
  6358. | [94403] Apache Santuario (XML Security for C++) InclusiveNamespace PrefixList Processing Heap Overflow
  6359. | [94402] Apache Santuario (XML Security for C++) HMAC-based XML Signature Processing DoS
  6360. | [94401] Apache Santuario (XML Security for C++) XPointer Evaluation Stack Overflow
  6361. | [94400] Apache Santuario (XML Security for C++) HMAC-Based XML Signature Reference Element Validation Spoofing Weakness
  6362. | [94279] Apache Qpid CA Certificate Validation Bypass
  6363. | [94275] Apache Solr JettySolrRunner.java Can Not Find Error Message XSS
  6364. | [94233] Apache OpenJPA Object Deserialization Arbitrary Executable Creation
  6365. | [94042] Apache Axis JAX-WS Java Unspecified Exposure
  6366. | [93969] Apache Struts OGNL Expression Handling Double Evaluation Error Remote Command Execution
  6367. | [93796] Apache Subversion Filename Handling FSFS Repository Corruption Remote DoS
  6368. | [93795] Apache Subversion svnserve Server Aborted Connection Message Handling Remote DoS
  6369. | [93794] Apache Subversion contrib/hook-scripts/check-mime-type.pl svnlook Hyphenated argv Argument Handling Remote DoS
  6370. | [93793] Apache Subversion contrib/hook-scripts/svn-keyword-check.pl Filename Handling Remote Command Execution
  6371. | [93646] Apache Struts Crafted Parameter Arbitrary OGNL Code Execution
  6372. | [93645] Apache Struts URL / Anchor Tag includeParams Attribute Remote Command Execution
  6373. | [93636] Apache Pig Multiple Physical Operator Memory Exhaustion Remote Remote DoS
  6374. | [93635] Apache Wink DTD (Document Type Definition) Expansion Data Parsing Information Disclosure
  6375. | [93605] RT Apache::Session::File Session Replay Reuse Information Disclosure
  6376. | [93599] Apache Derby SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY Boot Password Manipulation Re-encryption Failure Password Corruption
  6377. | [93555] Apache Commons Codec Invalid Base32 String Information Tunneling Weakness
  6378. | [93554] Apache HBase bulkLoadHFiles() Method ACL Bypass
  6379. | [93543] JBoss Enterprise Application Platform org.apache.catalina.connector.Response.encodeURL() Method MitM jsessionid Disclosure
  6380. | [93542] Apache ManifoldCF (Connectors Framework) org.apache.manifoldcf.crawler.ExportConfiguration Class Configuration Export Password Disclosure
  6381. | [93541] Apache Solr json.wrf Callback XSS
  6382. | [93524] Apache Hadoop GetSecurityDescriptorControl() Function Absolute Security Descriptor Handling NULL Descriptor Weakness
  6383. | [93521] Apache jUDDI Security API Token Session Persistence Weakness
  6384. | [93520] Apache CloudStack Default SSL Key Weakness
  6385. | [93519] Apache Shindig /ifr Cross-site Arbitrary Gadget Invocation
  6386. | [93518] Apache Solr /admin/analysis.jsp name Parameter XSS
  6387. | [93517] Apache CloudStack setup-cloud-management /etc/sudoers Modification Local Privilege Escalation
  6388. | [93516] Apache CXF UsernameTokenInterceptor Nonce Caching Replay Weakness
  6389. | [93515] Apache HBase table.jsp name Parameter XSS
  6390. | [93514] Apache CloudStack Management Server Unauthenticated Remote JMX Connection Default Setting Weakness
  6391. | [93463] Apache Struts EL / OGNL Interpretation Unspecified Remote Code Execution
  6392. | [93462] Apache CXF WS-SecurityPolicy AlgorithmSuite Arbitrary Ciphertext Decryption Weakness
  6393. | [93401] Apache Hadoop core-site.xml Permission Weakness Local Alfredo Secret Disclosure
  6394. | [93400] Apache Hadoop Map/Reduce Job Log Directory Symlink Arbitrary File Mode Manipulation
  6395. | [93397] Apache Wicket Referrer HTTP Header Session ID Disclosure
  6396. | [93366] Apache HTTP Server modules/mappers/mod_rewrite.c do_rewritelog() Function Log File Terminal Escape Sequence Filtering Remote Command Execution
  6397. | [93254] Apache Tomcat AsyncListener Method Cross-session Information Disclosure
  6398. | [93253] Apache Tomcat Chunked Transfer Encoding Data Saturation Remote DoS
  6399. | [93252] Apache Tomcat FORM Authenticator Session Fixation
  6400. | [93172] Apache Camel camel/endpoints/ Endpoint XSS
  6401. | [93171] Apache Sling HtmlResponse Error Message XSS
  6402. | [93170] Apache Directory DelegatingAuthenticator MitM Spoofing Weakness
  6403. | [93169] Apache Wave AuthenticationServlet.java Session Fixation Weakness
  6404. | [93168] Apache Click ErrorReport.java id Parameter XSS
  6405. | [93167] Apache ActiveMQ JMSXUserId Spoofing Weakness
  6406. | [93166] Apache CXF Crafted Message Element Count Handling System Resource Exhaustion Remote DoS
  6407. | [93165] Apache CXF Crafted Message Element Level Handling System Resource Exhaustion Remote DoS
  6408. | [93164] Apache Harmony DatagramSocket Class connect Method CheckAccept() IP Blacklist Bypass
  6409. | [93163] Apache Hadoop Map/Reduce Daemon Symlink Arbitrary File Overwrite
  6410. | [93162] Apache VelocityStruts struts/ErrorsTool.getMsgs Error Message XSS
  6411. | [93161] Apache CouchDB Rewriter VM Atom Table Memory Exhaustion Remote DoS
  6412. | [93158] Apache Wicket BookmarkablePageLink Feature XSS CSRF
  6413. | [93157] Apache Struts UrlHelper.java s:url includeParams Functionality XSS
  6414. | [93156] Apache Tapestry Calendar Component datefield.js datefield Parameter XSS
  6415. | [93155] Apache Struts fielderror.ftl fielderror Parameter Error Message XSS
  6416. | [93154] Apache JSPWiki Edit.jsp createPages WikiPermission Bypass
  6417. | [93153] Apache PDFBox PDFXrefStreamParser Missing Element Handling PDF Parsing DoS
  6418. | [93152] Apache Hadoop HttpServer.java Multiple Function XSS
  6419. | [93151] Apache Shiro Search Filter userName Parameter LDAP Code Injection Weakness
  6420. | [93150] Apache Harmony java.net.SocketPermission Class boolean equals Function checkConnect() Weakness Host Name Retrieval
  6421. | [93149] Apache Harmony java.security.Provider Class void load Function checkSecurityAccess() Weakness
  6422. | [93148] Apache Harmony java.security.ProtectionDomain Class java.lang.String.toString() Function checkPermission() Weakness
  6423. | [93147] Apache Harmony java.net.URLConnection openConnection Function checkConnect Weakness Proxy Connection Permission Bypass
  6424. | [93146] Apache Harmony java.net.ServerSocket Class void implAccept Function checkAccept() Weakness SerSocket Subclass Creation
  6425. | [93145] Apache Qpid JMS Client Detached Session Frame Handling NULL Pointer Dereference Remote DoS
  6426. | [93144] Apache Solr Admin Command Execution CSRF
  6427. | [93009] Apache VCL XMLRPC API Unspecified Function Remote Privilege Escalation
  6428. | [93008] Apache VCL Web GUI Unspecified Remote Privilege Escalation
  6429. | [92997] Apache Commons Codec org.apache.commons.codec.net.URLCodec Fields Missing 'final' Thread-safety Unspecified Issue
  6430. | [92976] Apache ActiveMQ scheduled.jsp crontab Command XSS
  6431. | [92947] Apache Commons Codec org.apache.commons.codec.language.Soundex.US_ENGLISH_MAPPING Missing MS_PKGPROTECT Field Manipulation Unspecified Issue
  6432. | [92749] Apache CloudStack Predictable Hash Virtual Machine Console Console Access URL Generation
  6433. | [92748] Apache CloudStack VM Console Access Restriction Bypass
  6434. | [92709] Apache ActiveMQ Web Console Unauthenticated Remote Access
  6435. | [92708] Apache ActiveMQ Sample Web Application Broker Resource Consumption Remote DoS
  6436. | [92707] Apache ActiveMQ webapp/websocket/chat.js Subscribe Message XSS
  6437. | [92706] Apache ActiveMQ Debug Log Rendering XSS
  6438. | [92705] Apache ActiveMQ PortfolioPublishServlet.java refresh Parameter XSS
  6439. | [92270] Apache Tomcat Unspecified CSRF
  6440. | [92094] Apache Subversion mod_dav_svn Module Nonexistent URL Lock Request Handling NULL Pointer Dereference Remote DoS
  6441. | [92093] Apache Subversion mod_dav_svn Module Activity URL PROPFIND Request Handling NULL Pointer Dereference Remote DoS
  6442. | [92092] Apache Subversion mod_dav_svn Module Log REPORT Request Handling NULL Pointer Dereference Remote DoS
  6443. | [92091] Apache Subversion mod_dav_svn Module Node Property Handling Resource Exhaustion Remote DoS
  6444. | [92090] Apache Subversion mod_dav_svn Module Activity URL Lock Request Handling NULL Pointer Dereference Remote DoS
  6445. | [91774] Apache Commons Codec Unspecified Non-private Field Manipulation Weakness
  6446. | [91628] mod_ruid2 for Apache HTTP Server fchdir() Inherited File Descriptor chroot Restriction Bypass
  6447. | [91328] Apache Wicket $up$ Traversal Arbitrary File Access
  6448. | [91295] Apple Mac OS X Apache Unicode Character URI Handling Authentication Bypass
  6449. | [91235] Apache Rave /app/api/rpc/users/get User Object Hashed Password Remote Disclosure
  6450. | [91185] Munin Default Apache Configuration Permission Weakness Remote Information Disclosure
  6451. | [91173] Apache Wicket WebApplicationPath Constructor Bypass /WEB-INF/ Directory File Access
  6452. | [91172] Apache Wicket PackageResourceGuard File Extension Filter Bypass
  6453. | [91025] Apache Qpid qpid::framing::Buffer Class Multiple Method Out-of-bounds Access Remote DoS
  6454. | [91024] Apache Qpid federation_tag Attribute Handling Federated Interbroker Link Access Restriction Bypass
  6455. | [91023] Apache Qpid AMQP Type Decoder Exposure Array Size Value Handling Memory Consumption Remote DoS
  6456. | [91022] Apache Qpid qpid/cpp/include/qpid/framing/Buffer.h qpid::framing::Buffer::checkAvailable() Function Integer Overflow
  6457. | [90986] Apache Jena ARQ INSERT DATA Request Handling Overflow
  6458. | [90907] Apache Subversion mod_dav_svn / libsvn_fs svn_fs_file_length() Function MKACTIVITY / PROPFIND Option Request Handling Remote DoS
  6459. | [90906] Apache Commons FileUpload /tmp Storage Symlink Arbitrary File Overwrite
  6460. | [90864] Apache Batik 1xx Redirect Script Origin Restriction Bypass
  6461. | [90858] Apache Ant Malformed TAR File Handling Infinite Loop DoS
  6462. | [90852] Apache HTTP Server for Debian apachectl /var/lock Permission Weakness Symlink Directory Permission Manipulation
  6463. | [90804] Apache Commons CLI Path Subversion Local Privilege Escalation
  6464. | [90802] Apache Avro Recursive Schema Handling Infinite Recursion DoS
  6465. | [90592] Apache Batik ApplicationSecurityEnforcer.java Multiple Method Security Restriction Bypass
  6466. | [90591] Apache Batik XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
  6467. | [90565] Apache Tomcat Log Directory Permission Weakness Local Information Disclosure
  6468. | [90564] Apache Maven / Maven Wagon SSL Certificate Validation MitM Spoofing Weakness
  6469. | [90557] Apache HTTP Server mod_proxy_balancer balancer-manager Interface Multiple Parameter XSS
  6470. | [90556] Apache HTTP Server Multiple Module Multiple Parameter XSS
  6471. | [90276] Apache Axis2 axis2.xml Plaintext Password Local Disclosure
  6472. | [90249] Apache Axiom ClassLoader XMLInputFactory / XMLOutputFactory Construction Unspecified Issue
  6473. | [90235] Apache Commons HttpClient Certificate Wildcard Matching Weakness
  6474. | [90079] Apache CXF WSS4JInInterceptor URIMappingInterceptor WS-Security SOAP Service Access Restriction Bypass
  6475. | [90078] Apache CXF WS-SecurityPolicy Enabled Plaintext UsernameTokens Handling Authentication Bypass
  6476. | [89453] Apache Open For Business Project (OFBiz) Screenlet.title Widget Attribute XSS
  6477. | [89452] Apache Open For Business Project (OFBiz) Image.alt Widget Attribute XSS
  6478. | [89294] Apache CouchDB Futon UI Browser-based Test Suite Query Parameter XSS
  6479. | [89293] Apache CouchDB Unspecified Traversal Arbitrary File Access
  6480. | [89275] Apache HTTP Server mod_proxy_ajp Module Expensive Request Parsing Remote DoS
  6481. | [89267] Apache CouchDB JSONP Callback Handling Unspecified XSS
  6482. | [89146] Apache CloudStack Master Server log4j.conf SSH Private Key / Plaintext Password Disclosure
  6483. | [88603] Apache OpenOffice.org (OOo) Unspecified Information Disclosure
  6484. | [88602] Apache OpenOffice.org (OOo) Unspecified Manifest-processing Issue
  6485. | [88601] Apache OpenOffice.org (OOo) Unspecified PowerPoint File Handling Issue
  6486. | [88285] Apache Tomcat Partial HTTP Request Saturation Remote DoS
  6487. | [88095] Apache Tomcat NIO Connector Terminated Connection Infinte Loop DoS
  6488. | [88094] Apache Tomcat FORM Authentication Crafted j_security_check Request Security Constraint Bypass
  6489. | [88093] Apache Tomcat Null Session Requst CSRF Prevention Filter Bypass
  6490. | [88043] IBM Tivoli Netcool/Reporter Apache CGI Unspecified Remote Command Execution
  6491. | [87580] Apache Tomcat DIGEST Authentication Session State Caching Authentication Bypass Weakness
  6492. | [87579] Apache Tomcat DIGEST Authentication Stale Nonce Verification Authentication Bypass Weakness
  6493. | [87477] Apache Tomcat Project Woodstock Service Error Page UTF-7 XSS Weakness
  6494. | [87227] Apache Tomcat InternalNioInputBuffer.java parseHeaders() Function Request Header Size Parsing Remote DoS
  6495. | [87223] Apache Tomcat DIGEST Authentication replay-countermeasure Functionality cnonce / cn Verification Authentication Bypass Weakness
  6496. | [87160] Apache Commons HttpClient X.509 Certificate Domain Name Matching MiTM Weakness
  6497. | [87159] Apache CXF X.509 Certificate Domain Name Matching MiTM Weakness
  6498. | [87150] Apache Axis / Axis2 X.509 Certificate Domain Name Matching MiTM Weakness
  6499. | [86902] Apache HTTP Server 3xx Redirect Internal IP Address Remote Disclosure
  6500. | [86901] Apache Tomcat Error Message Path Disclosure
  6501. | [86684] Apache CloudStack Unauthorized Arbitrary API Call Invocation
  6502. | [86556] Apache Open For Business Project (OFBiz) Unspecified Issue
  6503. | [86503] Visual Tools VS home/apache/DiskManager/cron/init_diskmgr Local Command Execution
  6504. | [86401] Apache ActiveMQ ResourceHandler Traversal Arbitrary File Access
  6505. | [86225] Apache Axis2 XML Signature Wrapping (XSW) Authentication Bypass
  6506. | [86206] Apache Axis2 Crafted SAML Assertion Signature Exclusion Attack Authentication Bypass
  6507. | [85722] Apache CXF SOAP Request Parsing Access Restriction Bypass
  6508. | [85704] Apache Qpid Incoming Client Connection Saturation Remote DoS
  6509. | [85474] Eucalyptus Apache Santuario (XML Security for Java) Library XML Signature Transform Handling DoS
  6510. | [85430] Apache mod_pagespeed Module Unspecified XSS
  6511. | [85429] Apache mod_pagespeed Module Hostname Verification Cross-host Resource Disclosure
  6512. | [85249] Apache Wicket Unspecified XSS
  6513. | [85236] Apache Hadoop conf/hadoop-env.sh Temporary File Symlink Arbitrary File Manipulation
  6514. | [85090] Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure
  6515. | [85089] Apache HTTP Server mod_proxy_http.c mod_proxy_http Module Cross-client Information Disclosure
  6516. | [85062] Apache Solr Autocomplete Module for Drupal Autocomplete Results XSS
  6517. | [85010] Apache Struts Token Handling Mechanism Token Name Configuration Parameter CSRF Weakness
  6518. | [85009] Apache Struts Request Parameter OGNL Expression Parsing Remote DoS
  6519. | [84911] libapache2-mod-rpaf X-Forward-For HTTP Header Parsing Remote DoS
  6520. | [84823] Apache HTTP Server Multiple Module Back End Server Error Handling HTTP Request Parsing Remote Information Disclosure
  6521. | [84818] Apache HTTP Server mod_negotiation Module mod_negotiation.c make_variant_list Function XSS
  6522. | [84562] Apache Qpid Broker Authentication Mechanism AMQP Client Shadow Connection NullAuthenticator Request Parsing Authentication Bypass
  6523. | [84458] Apache Libcloud SSL Certificate Validation MitM Spoofing Weakness
  6524. | [84279] PHP on Apache php_default_post_reader POST Request Handling Overflow DoS
  6525. | [84278] PHP w/ Apache PDO::ATTR_DEFAULT_FETCH_MODE / PDO::FETCH_CLASS DoS
  6526. | [84231] Apache Hadoop DataNodes Client BlockTokens Arbitrary Block Access
  6527. | [83943] Oracle Solaris Cluster Apache Tomcat Agent Subcomponent Unspecified Local Privilege Escalation
  6528. | [83939] Oracle Solaris Apache HTTP Server Subcomponent Unspecified Remote Information Disclosure
  6529. | [83685] svnauthcheck Apache HTTP Configuration File Permission Revocation Weakness
  6530. | [83682] Apache Sling POST Servlet @CopyFrom Operation HTTP Request Parsing Infinite Loop Remote DoS
  6531. | [83339] Apache Roller Blogger Roll Unspecified XSS
  6532. | [83270] Apache Roller Unspecified Admin Action CSRF
  6533. | [82782] Apache CXF WS-SecurityPolicy 1.1 SupportingToken Policy Bypass
  6534. | [82781] Apache CXF WS-SecurityPolicy Supporting Token Children Specification Token Signing Verification Weakness
  6535. | [82611] cPanel Apache Piped Log Configuration Log Message Formatting Traversal Arbitrary File Creation
  6536. | [82436] MapServer for Windows Bundled Apache / PHP Configuration Local File Inclusion
  6537. | [82215] PHP sapi/cgi/cgi_main.c apache_request_headers Function HTTP Header Handling Remote Overflow
  6538. | [82161] Apache Commons Compress bzip2 File Compression BZip2CompressorOutputStream Class File Handling Remote DoS
  6539. | [81965] Apache Batik Squiggle SVG Browser JAR File Arbitrary Code Execution
  6540. | [81790] Apache POI src/org/apache/poi/hwpf/model/UnhandledDataStructure.java UnhandledDataStructure() constructor Length Attribute CDF / CFBF File Handling Remote DoS
  6541. | [81660] Apache Qpid Credential Checking Cluster Authentication Bypass
  6542. | [81511] Apache for Debian /usr/share/doc HTTP Request Parsing Local Script Execution
  6543. | [81359] Apache HTTP Server LD_LIBRARY_PATH Variable Local Privilege Escalation
  6544. | [81349] Apache Open For Business Project (OFBiz) Webslinger Component Unspecified XSS
  6545. | [81348] Apache Open For Business Project (OFBiz) Content IDs / Map-Keys Unspecified XSS
  6546. | [81347] Apache Open For Business Project (OFBiz) Parameter Arrays Unspecified XSS
  6547. | [81346] Apache Open For Business Project (OFBiz) checkoutProcess.js getServerError() Function Unspecified XSS
  6548. | [81196] Apache Open For Business Project (OFBiz) FlexibleStringExpander Nested Script String Parsing Remote Code Execution
  6549. | [80981] Apache Hadoop Kerberos/MapReduce Security Feature User Impersonation Weakness
  6550. | [80571] Apache Traffic Server Host HTTP Header Parsing Remote Overflow
  6551. | [80547] Apache Struts XSLTResult.java File Upload Arbitrary Command Execution
  6552. | [80360] AskApache Password Protector Plugin for WordPress Error Page $_SERVER Superglobal XSS
  6553. | [80349] Apache HTTP Server mod_fcgid Module fcgid_spawn_ctl.c FcgidMaxProcessesPerClass Virtual Host Directive HTTP Request Parsing Remote DoS
  6554. | [80301] Apache Wicket /resources/ Absolute Path Arbitrary File Access
  6555. | [80300] Apache Wicket wicket:pageMapName Parameter XSS
  6556. | [79478] Apache Solr Extension for TYPO3 Unspecified XSS
  6557. | [79002] Apache MyFaces javax.faces.resource In Parameter Traversal Arbitrary File Access
  6558. | [78994] Apache Struts struts-examples/upload/upload-submit.do name Parameter XSS
  6559. | [78993] Apache Struts struts-cookbook/processDyna.do message Parameter XSS
  6560. | [78992] Apache Struts struts-cookbook/processSimple.do message Parameter XSS
  6561. | [78991] Apache Struts struts2-rest-showcase/orders clientName Parameter XSS
  6562. | [78990] Apache Struts struts2-showcase/person/editPerson.action Multiple Parameter XSS
  6563. | [78932] Apache APR Hash Collision Form Parameter Parsing Remote DoS
  6564. | [78903] Apache CXF SOAP Request Parsing WS-Security UsernameToken Policy Bypass
  6565. | [78600] Apache Tomcat HTTP DIGEST Authentication DigestAuthenticator.java Catalina Weakness Security Bypass
  6566. | [78599] Apache Tomcat HTTP DIGEST Authentication Realm Value Parsing Security Bypass
  6567. | [78598] Apache Tomcat HTTP DIGEST Authentication qop Value Parsing Security Bypass
  6568. | [78573] Apache Tomcat Parameter Saturation CPU Consumption Remote DoS
  6569. | [78556] Apache HTTP Server Status Code 400 Default Error Response httpOnly Cookie Disclosure
  6570. | [78555] Apache HTTP Server Threaded MPM %{cookiename}C Log Format String Cookie Handling Remote DoS
  6571. | [78501] Apache Struts ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution
  6572. | [78331] Apache Tomcat Request Object Recycling Information Disclosure
  6573. | [78293] Apache HTTP Server Scoreboard Invalid Free Operation Local Security Bypass
  6574. | [78277] Apache Struts ExceptionDelegator Component Parameter Parsing Remote Code Execution
  6575. | [78276] Apache Struts DebuggingInterceptor Component Developer Mode Unspecified Remote Command Execution
  6576. | [78113] Apache Tomcat Hash Collision Form Parameter Parsing Remote DoS
  6577. | [78112] Apache Geronimo Hash Collision Form Parameter Parsing Remote DoS
  6578. | [78109] Apache Struts ParameterInterceptor Traversal Arbitrary File Overwrite
  6579. | [78108] Apache Struts CookieInterceptor Cookie Name Handling Remote Command Execution
  6580. | [77593] Apache Struts Conversion Error OGNL Expression Injection
  6581. | [77496] Apache ActiveMQ Failover Mechanism Openwire Request Parsing Remote DoS
  6582. | [77444] Apache HTTP Server mod_proxy Mdule Web Request HTTP/0.9 Protocol URL Parsing Proxy Remote Security Bypass
  6583. | [77374] Apache MyFaces Java Bean includeViewParameters Parsing EL Expression Security Weakness
  6584. | [77310] Apache HTTP Server mod_proxy Reverse Proxy Mode Security Bypass Weakness (2011-4317)
  6585. | [77234] Apache HTTP Server on cygwin Encoded Traversal Arbitrary File Access
  6586. | [77012] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Memory Consumption DoS
  6587. | [76944] Apache Tomcat Manager Application Servlets Access Restriction Bypass
  6588. | [76744] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Overflow
  6589. | [76189] Apache Tomcat HTTP DIGEST Authentication Weakness
  6590. | [76079] Apache HTTP Server mod_proxy Mdule Web Request URL Parsing Proxy Remote Security Bypass (2011-3368)
  6591. | [76072] Apache JServ jserv.conf jserv-status Handler jserv/ URI Request Parsing Local Information Disclosure
  6592. | [75807] Apache HTTP Server Incomplete Header Connection Saturation Remote DoS
  6593. | [75647] Apache HTTP Server mod_proxy_ajp Module mod_proxy_balancer HTTP Request Remote DoS
  6594. | [75376] Apache Libcloud SSL Certificate Validation MitM Server Spoofing Weakness
  6595. | [74853] Domain Technologie Control /etc/apache2/apache2.conf File Permissions Weakness dtcdaemons User Password Disclosure
  6596. | [74818] Apache Tomcat AJP Message Injection Authentication Bypass
  6597. | [74725] Apache Wicket Multi Window Support Unspecified XSS
  6598. | [74721] Apache HTTP Server ByteRange Filter Memory Exhaustion Remote DoS
  6599. | [74541] Apache Commons Daemon Jsvc Permissions Weakness Arbitrary File Access
  6600. | [74535] Apache Tomcat XML Parser Cross-application Multiple File Manipulation
  6601. | [74447] Apache Struts XWork Nonexistent Method s:submit Element Internal Java Class Remote Path Disclosure
  6602. | [74262] Apache HTTP Server Multi-Processing Module itk.c Configuration Merger mpm-itk root UID / GID Remote Privilege Escalation
  6603. | [74120] Apache HTTP Server mod_authnz_external mysql/mysql-auth.pl user Field SQL Injection
  6604. | [73920] Oracle Secure Backup /apache/htdocts/php/common.php username Parameter Remote Code Execution
  6605. | [73798] Apache Tomcat sendfile Request Start / Endpoint Parsing Local DoS
  6606. | [73797] Apache Tomcat sendfile Request Attribute Validation Weakness Local Access Restriction Bypass
  6607. | [73776] Apache Tomcat HTTP BIO Connector HTTP Pipelining Cross-user Remote Response Access
  6608. | [73644] Apache XML Security Signature Key Parsing Overflow DoS
  6609. | [73600] Apache Struts javatemplates Plugin Component Handlers .action URI Multiple Parameter XSS
  6610. | [73462] Apache Rampart/C util/rampart_timestamp_token.c rampart_timestamp_token_validate Function Expired Token Remote Access Restriction Bypass
  6611. | [73429] Apache Tomcat JMX MemoryUserDatabase Local Password Disclosure
  6612. | [73384] Apache HTTP Server mod_rewrite PCRE Resource Exhaustion DoS
  6613. | [73383] Apache HTTP Server Portable Runtime (APR) Library apr_fnmatch() Infinite Loop Remote DoS
  6614. | [73378] IBM WebSphere Application Server (WAS) JavaServer Pages org.apache.jasper.runtime.JspWriterImpl.response JSP Page Application Restart Remote DoS
  6615. | [73247] Apache Subversion mod_dav_svn File Permission Weakness Information Disclosure
  6616. | [73246] Apache Subversion mod_dav_svn Path-based Access Control Rule Handling Remote DoS
  6617. | [73245] Apache Subversion mod_dav_svn Baselined Resource Request Handling Remote DoS
  6618. | [73154] Apache Archiva Multiple Unspecified CSRF
  6619. | [73153] Apache Archiva /archiva/admin/deleteNetworkProxy!confirm.action proxyid Parameter XSS
  6620. | [72407] Apache Tomcat @ServletSecurity Initial Load Annotation Security Constraint Bypass Information Disclosure
  6621. | [72238] Apache Struts Action / Method Names &lt
  6622. | [71647] Apache HttpComponents HttpClient Proxy-Authorization Credentials Remote Disclosure
  6623. | [71558] Apache Tomcat SecurityManager ServletContext Attribute Traversal Arbitrary File Manipulation
  6624. | [71557] Apache Tomcat HTML Manager Multiple XSS
  6625. | [71075] Apache Archiva User Management Page XSS
  6626. | [71027] Apache Tomcat @ServletSecurity Annotation Security Constraint Bypass Information Disclosure
  6627. | [70925] Apache Continuum Project Pages Unspecified XSS (2011-0533)
  6628. | [70924] Apache Continuum Multiple Admin Function CSRF
  6629. | [70809] Apache Tomcat NIO HTTP Connector Request Line Processing DoS
  6630. | [70734] Apache CouchDB Request / Cookie Handling Unspecified XSS
  6631. | [70585] Oracle Fusion Middleware Oracle HTTP Server Apache Plugin Unspecified Remote Issue
  6632. | [70333] Apache Subversion rev_hunt.c blame Command Multiple Memory Leak Remote DoS
  6633. | [70332] Apache Subversion Apache HTTP Server mod_dav_svn repos.c walk FunctionSVNParentPath Collection Remote DoS
  6634. | [69659] Apache Archiva Admin Authentication Weakness Privilege Escalation
  6635. | [69520] Apache Archiva Administrator Credential Manipulation CSRF
  6636. | [69512] Apache Tomcat Set-Cookie Header HTTPOnly Flag Session Hijacking Weakness
  6637. | [69456] Apache Tomcat Manager manager/html/sessions Multiple Parameter XSS
  6638. | [69275] Apache mod_fcgid Module fcgid_bucket.c fcgid_header_bucket_read() Function Remote Overflow
  6639. | [69067] Apache Shiro URI Path Security Traversal Information Disclosure
  6640. | [68815] Apache MyFaces shared/util/StateUtils.java View State MAC Weakness Cryptographic Padding Remote View State Modification
  6641. | [68670] Apache Qpid C++ Broker Component broker/SessionAdapter.cpp SessionAdapter::ExchangeHandlerImpl::checkAlternate Function Exchange Alternate Remote DoS
  6642. | [68669] Apache Qpid cluster/Cluster.cpp Cluster::deliveredEvent Function Invalid AMQP Data Remote DoS
  6643. | [68662] Apache Axis2 dswsbobje.war Module Admin Account Default Password
  6644. | [68531] Apache Qpid qpidd sys/ssl/SslSocket.cpp Incomplete SSL Handshake Remote DoS
  6645. | [68327] Apache APR-util buckets/apr_brigade.c apr_brigade_split_line() Function Memory Consumption DoS
  6646. | [68314] Apache XML-RPC SAX Parser External Entity Information Disclosure
  6647. | [67964] Apache Traffic Server Transaction ID / Source Port Randomization Weakness DNS Cache Poisoning
  6648. | [67846] SUSE Lifecycle Management Server on SUSE Linux Enterprise apache2-slms Parameter Quoting CSRF
  6649. | [67294] Apache CXF XML SOAP Message Crafted Document Type Declaration Remote DoS
  6650. | [67240] Apache CouchDB Installation Page Direct Request Arbitrary JavaScript Code Execution CSRF
  6651. | [67205] Apache Derby BUILTIN Authentication Password Hash Generation Algorithm SHA-1 Transformation Password Substitution
  6652. | [66745] Apache HTTP Server Multiple Modules Pathless Request Remote DoS
  6653. | [66319] Apache Tomcat Crafted Transfer-Encoding Header Handling Buffer Recycling Remote DoS
  6654. | [66280] Apache Struts XWork ParameterInterceptor Server-Side Object Remote Code Execution
  6655. | [66226] Apache Axis2 Admin Interface Cookie Session Fixation
  6656. | [65697] Apache Axis2 / Java SOAP Message DTD Rejection Weakness Arbitrary File Access
  6657. | [65654] Apache HTTP Server mod_proxy_http mod_proxy_http.c Timeout Detection Weakness HTTP Request Response Disclosure
  6658. | [65429] Apache MyFaces Unencrypted ViewState Serialized View Object Manipulation Arbitrary Expression Language (EL) Statement Execution
  6659. | [65054] Apache ActiveMQ Jetty Error Handler XSS
  6660. | [64844] Apache Axis2/Java axis2/axis2-admin/engagingglobally modules Parameter XSS
  6661. | [64522] Apache Open For Business Project (OFBiz) ecommerce/control/contactus Multiple Parameter XSS
  6662. | [64521] Apache Open For Business Project (OFBiz) Web Tools Section entityName Parameter XSS
  6663. | [64520] Apache Open For Business Project (OFBiz) ecommerce/control/ViewBlogArticle contentId Parameter XSS
  6664. | [64519] Apache Open For Business Project (OFBiz) Control Servlet URI XSS
  6665. | [64518] Apache Open For Business Project (OFBiz) Show Portal Page Section start Parameter XSS
  6666. | [64517] Apache Open For Business Project (OFBiz) View Profile Section partyId Parameter XSS
  6667. | [64516] Apache Open For Business Project (OFBiz) Export Product Listing Section productStoreId Parameter XSS
  6668. | [64307] Apache Tomcat Web Application Manager/Host Manager CSRF
  6669. | [64056] mod_auth_shadow for Apache HTTP Server wait() Function Authentication Bypass
  6670. | [64023] Apache Tomcat WWW-Authenticate Header Local Host Information Disclosure
  6671. | [64020] Apache ActiveMQ Jetty ResourceHandler Crafted Request JSP File Source Disclosure
  6672. | [63895] Apache HTTP Server mod_headers Unspecified Issue
  6673. | [63368] Apache ActiveMQ createDestination.action JMSDestination Parameter CSRF
  6674. | [63367] Apache ActiveMQ createDestination.action JMSDestination Parameter XSS
  6675. | [63350] Apache CouchDB Hash Verification Algorithm Predictable Execution Time Weakness
  6676. | [63140] Apache Thrift Service Malformed Data Remote DoS
  6677. | [62676] Apache HTTP Server mod_proxy_ajp Module Crafted Request Remote DoS
  6678. | [62675] Apache HTTP Server Multi-Processing Module (MPM) Subrequest Header Handling Cross-thread Information Disclosure
  6679. | [62674] Apache HTTP Server mod_isapi Module Unloading Crafted Request Remote DoS
  6680. | [62231] Apache HTTP Server Logging Format Weakness Crafted DNS Response IP Address Spoofing
  6681. | [62230] Apache HTTP Server Crafted DNS Response Inverse Lookup Log Corruption XSS
  6682. | [62054] Apache Tomcat WAR Filename Traversal Work-directory File Deletion
  6683. | [62053] Apache Tomcat Autodeployment Process appBase File HTTP Request Authentication Bypass
  6684. | [62052] Apache Tomcat WAR File Traversal Arbitrary File Overwrite
  6685. | [62009] Apache HTTP Server src/modules/proxy/proxy_util.c mod_proxy ap_proxy_send_fb() Function Overflow
  6686. | [61379] Apache River Outrigger Entry Storage Saturation Memory Exhaustion DoS
  6687. | [61378] Apache Hadoop Map/Reduce JobTracker Memory Consumption DoS
  6688. | [61377] Apache Commons Modeler Multiple Mutable Static Fields Weakness
  6689. | [61376] Apache Rampart wsse:security Tag Signature Value Checking Weakness
  6690. | [60687] Apache C++ Standard Library (STDCXX) strxfrm() Function Overflow
  6691. | [60680] Apache Hadoop JobHistory Job Name Manipulation Weakness
  6692. | [60679] Apache ODE DeploymentWebService OMElement zipPart CRLF Injection
  6693. | [60678] Apache Roller Comment Email Notification Manipulation DoS
  6694. | [60677] Apache CouchDB Unspecified Document Handling Remote DoS
  6695. | [60428] Sun Java Plug-in org.apache.crimson.tree.XmlDocument Class reateXmlDocument Method Floppy Drive Access Bypass
  6696. | [60413] mod_throttle for Apache Shared Memory File Manipulation Local Privilege Escalation
  6697. | [60412] Sun Java Plug-in org.apache.xalan.processor.XSLProcessorVersion Class Unsigned Applet Variable Sharing Privilege Escalation
  6698. | [60396] Apache HTTP Server on OpenBSD Multipart MIME Boundary Remote Information Disclosure
  6699. | [60395] Apache HTTP Server on OpenBSD ETag HTTP Header Remote Information Disclosure
  6700. | [60232] PHP on Apache php.exe Direct Request Remote DoS
  6701. | [60176] Apache Tomcat Windows Installer Admin Default Password
  6702. | [60016] Apache HTTP Server on HP Secure OS for Linux HTTP Request Handling Unspecified Issue
  6703. | [59979] Apache HTTP Server on Apple Mac OS X HTTP TRACE Method Unspecified Client XSS
  6704. | [59969] Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection
  6705. | [59944] Apache Hadoop jobhistory.jsp XSS
  6706. | [59374] Apache Solr Search Extension for TYPO3 Unspecified XSS
  6707. | [59022] Apache Shindig ConcatProxyServlet HTTP Header Response Splitting
  6708. | [59021] Apache Cocoon X-Cocoon-Version Header Remote Information Disclosure
  6709. | [59020] Apache Tapestry HTTPS Session Cookie Secure Flag Weakness
  6710. | [59019] Apache mod_python Cookie Salting Weakness
  6711. | [59018] Apache Harmony Error Message Handling Overflow
  6712. | [59013] Apache Derby SYSCS_EXPORT_TABLE Arbitrary File Overwrite
  6713. | [59012] Apache Derby Driver Auto-loading Non-deterministic Startup Weakness
  6714. | [59011] Apache JSPWiki Page Attachment Change Note Function XSS
  6715. | [59010] Apache Solr get-file.jsp XSS
  6716. | [59009] Apache Solr action.jsp XSS
  6717. | [59008] Apache Solr analysis.jsp XSS
  6718. | [59007] Apache Solr schema.jsp Multiple Parameter XSS
  6719. | [59006] Apache Beehive select / checkbox Tag XSS
  6720. | [59005] Apache Beehive jpfScopeID Global Parameter XSS
  6721. | [59004] Apache Beehive Error Message XSS
  6722. | [59003] Apache HttpClient POST Request Handling Memory Consumption DoS
  6723. | [59002] Apache Jetspeed default-page.psml URI XSS
  6724. | [59001] Apache Axis2 xsd Parameter Traversal Arbitrary File Disclosure
  6725. | [59000] Apache CXF Unsigned Message Policy Bypass
  6726. | [58999] Apache WSS4J CallbackHandler Plaintext Password Validation Weakness
  6727. | [58998] Apache OpenJPA persistence.xml Cleartext Password Local Disclosure
  6728. | [58997] Apache OpenEJB openejb.xml Cleartext Password Local Disclosure
  6729. | [58996] Apache Hadoop Map/Reduce LinuxTaskController File Group Ownership Weakness
  6730. | [58995] Apache Hadoop Map/Reduce Task Ownership Weakness
  6731. | [58994] Apache Hadoop Map/Reduce DistributedCache Localized File Permission Weakness
  6732. | [58993] Apache Hadoop browseBlock.jsp XSS
  6733. | [58991] Apache Hadoop browseDirectory.jsp XSS
  6734. | [58990] Apache Hadoop Map/Reduce HTTP TaskTrackers User Data Remote Disclosure
  6735. | [58989] Apache Hadoop Sqoop Process Listing Local Cleartext Password Disclosure
  6736. | [58988] Apache Hadoop Chukwa HICC Portal Unspecified XSS
  6737. | [58987] Apache Hadoop Map/Reduce TaskTracker User File Permission Weakness
  6738. | [58986] Apache Qpid Encrypted Message Handling Remote Overflow DoS
  6739. | [58985] Apache Qpid Process Listing Local Cleartext Password Disclosure
  6740. | [58984] Apache Jackrabbit Content Repository (JCR) Default Account Privilege Access Weakness
  6741. | [58983] Apache Jackrabbit Content Repository (JCR) NamespaceRegistry API Registration Method Race Condition
  6742. | [58982] Apache Synapse Proxy Service Security Policy Mismatch Weakness
  6743. | [58981] Apache Geronimo TomcatGeronimoRealm Security Context Persistence Weakness
  6744. | [58980] Apache Geronimo LDAP Realm Configuration Restart Reversion Weakness
  6745. | [58979] Apache MyFaces Tomahawk ExtensionsPhaseListener HTML Injection Information Disclosure
  6746. | [58978] Apache MyFaces Trinidad LocaleInfoScriptlet XSS
  6747. | [58977] Apache Open For Business Project (OFBiz) Multiple Default Accounts
  6748. | [58976] Apache Open For Business Project (OFBiz) URI passThru Parameter XSS
  6749. | [58975] Apache Open For Business Project (OFBiz) PARTYMGR_CREATE/UPDATE Permission Arbitrary User Password Modification
  6750. | [58974] Apache Sling /apps Script User Session Management Access Weakness
  6751. | [58973] Apache Tuscany Crafted SOAP Request Access Restriction Bypass
  6752. | [58931] Apache Geronimo Cookie Parameters Validation Weakness
  6753. | [58930] Apache Xalan-C++ XPath Handling Remote DoS
  6754. | [58879] Apache Portable Runtime (APR-util) poll/unix/port.c Event Port Backend Pollset Feature Remote DoS
  6755. | [58837] Apache Commons Net FTPSClient CipherSuites / Protocols Mutable Object Unspecified Data Security Issue
  6756. | [58813] Apache MyFaces Trinidad tr:table / HTML Comment Handling DoS
  6757. | [58812] Apache Open For Business Project (OFBiz) JSESSIONID Session Hijacking Weakness
  6758. | [58811] Apache Open For Business Project (OFBiz) /catalog/control/EditProductConfigItem configItemId Parameter XSS
  6759. | [58810] Apache Open For Business Project (OFBiz) /catalog/control/EditProdCatalo prodCatalogId Parameter XSS
  6760. | [58809] Apache Open For Business Project (OFBiz) /partymgr/control/viewprofile partyId Parameter XSS
  6761. | [58808] Apache Open For Business Project (OFBiz) /catalog/control/createProduct internalName Parameter XSS
  6762. | [58807] Apache Open For Business Project (OFBiz) Multiple Unspecified CSRF
  6763. | [58806] Apache FtpServer MINA Logging Filter Cleartext Credential Local Disclosure
  6764. | [58805] Apache Derby Unauthenticated Database / Admin Access
  6765. | [58804] Apache Wicket Header Contribution Unspecified Issue
  6766. | [58803] Apache Wicket Session Fixation
  6767. | [58802] Apache Directory Server (ApacheDS) userPassword Attribute Search Password Disclosure
  6768. | [58801] Apache ActiveMQ Stomp Client Credential Validation Bypass
  6769. | [58800] Apache Tapestry (context)/servicestatus Internal Service Information Disclosure
  6770. | [58799] Apache Tapestry Logging Cleartext Password Disclosure
  6771. | [58798] Apache Jetspeed pipeline Parameter pipeline-map Policy Bypass
  6772. | [58797] Apache Jetspeed Password Policy Multiple Weaknesses
  6773. | [58796] Apache Jetspeed Unsalted Password Storage Weakness
  6774. | [58795] Apache Rampart Crafted SOAP Header Authentication Bypass
  6775. | [58794] Apache Roller Admin Protocol (RAP) Malformed Header Authentication Bypass
  6776. | [58793] Apache Hadoop Map/Reduce mapred.system.dir Permission Weakness Job Manipulation
  6777. | [58792] Apache Shindig gadgets.rpc iframe RPC Call Validation Weakness
  6778. | [58791] Apache Synapse synapse.properties Cleartext Credential Local Disclosure
  6779. | [58790] Apache WSS4J SOAP Message UsernameToken Remote Password Disclosure
  6780. | [58789] Apache WSS4J SOAP Header Malformed UsernameToken Authentication Bypass
  6781. | [58776] Apache JSPWiki PreviewContent.jsp Edited Text XSS
  6782. | [58775] Apache JSPWiki preview.jsp action Parameter XSS
  6783. | [58774] Apache JSPWiki Edit.jsp Multiple Parameter XSS
  6784. | [58773] Apache JSPWiki Accept-Language Header Multiple Script language Parameter XSS
  6785. | [58772] Apache JSPWiki EditorManager.java editor Parameter XSS
  6786. | [58771] Apache JSPWiki GroupContent.jsp Multiple Parameter XSS
  6787. | [58770] Apache JSPWiki Group.jsp group Parameter XSS
  6788. | [58769] Apache JSPWiki Database Connection Termination DoS Weakness
  6789. | [58768] Apache JSPWiki Attachment Servlet nextpage Parameter Arbitrary Site Redirect
  6790. | [58766] Apache JSPWiki /admin/SecurityConfig.jsp Direct Request Information Disclosure
  6791. | [58765] Apache JSPWiki Spam Filter UniqueID RNG Weakness
  6792. | [58764] Apache JSPWiki Edit.jsp Multiple Parameter XSS
  6793. | [58763] Apache JSPWiki Include Tag Multiple Script XSS
  6794. | [58762] Apache JSPWiki Multiple .java Tags pageContext Parameter XSS
  6795. | [58761] Apache JSPWiki Wiki.jsp skin Parameter XSS
  6796. | [58760] Apache Commons VFS Exception Error Message Cleartext Credential Disclosure
  6797. | [58759] Apache Jackrabbit Content Repository (JCR) UUID System.currentTimeMillis() RNG Weakness
  6798. | [58758] Apache River GrantPermission Policy Manipulation Privilege Escalation
  6799. | [58757] Apache WS-Commons Java2 StaXUtils Multiple Unspecified Minor Issues
  6800. | [58756] Apache WSS4J WSHandler Client Certificate Signature Validation Weakness
  6801. | [58755] Apache Harmony DRLVM Non-public Class Member Access
  6802. | [58754] Apache Harmony File.createTempFile() Temporary File Creation Prediction Weakness
  6803. | [58751] Apache Geronimo GeronimoIdentityResolver Subject Handling Multiple Issues
  6804. | [58750] Apache MyFaces Trinidad Generated HTML Information Disclosure
  6805. | [58749] Apache MyFaces Trinidad Database Access Error Message Information Disclosure
  6806. | [58748] Apache MyFaces Trinidad Image Resource Loader Traversal Arbitrary Image Access
  6807. | [58747] Apache MyFaces Trinidad Error Message User Entered Data Disclosure Weakness
  6808. | [58746] Apache Axis2 JAX-WS Java2 WSDL4J Unspecified Issue
  6809. | [58744] Apache Wicket Crafted File Upload Disk Space Exhaustion DoS
  6810. | [58743] Apache Wicket wicket.util.crypt.SunJceCrypt Encryption Reversion Weakness
  6811. | [58742] Apache Rampart PolicyBasedValiadtor HttpsToken Endpoint Connection Weakness
  6812. | [58741] Apache Rampart WSSecSignature / WSSecEncryptedKey KeyIdentifierType Validation Weakness
  6813. | [58740] Apache Rampart TransportBinding Message Payload Cleartext Disclosure
  6814. | [58739] Apache Open For Business Project (OFBiz) Unsalted Password Storage Weakness
  6815. | [58738] Apache Open For Business Project (OFBiz) orderId Parameter Arbitrary Order Access
  6816. | [58737] Apache mod_python w/ mod_python.publisher index.py Underscore Prefixed Variable Disclosure
  6817. | [58735] Apache Open For Business Project (OFBiz) /ecommerce/control/keywordsearch SEARCH_STRING Parameter XSS
  6818. | [58734] Apache Torque Log File Cleartext Credential Local Disclosure
  6819. | [58733] Apache Axis2 doGet Implementation Authentication Bypass Service State Manipulation
  6820. | [58732] Apache MyFaces UIInput.validate() Null Value Validation Bypass Weakness
  6821. | [58731] Apache MyFaces /faces/* Prefix Mapping Authentication Bypass
  6822. | [58725] Apache Tapestry Basic String ACL Bypass Weakness
  6823. | [58724] Apache Roller Logout Functionality Failure Session Persistence
  6824. | [58723] Apache Roller User Profile / Admin Page Cleartext Password Disclosure
  6825. | [58722] Apache Derby Connection URL Encryption Method Reversion Weakness
  6826. | [58721] Apache Geronimo on Tomcat Security-constraint Resource ACL Bypass
  6827. | [58720] Apache Geronimo Explicit Servlet Mapping Access Bypass Weakness
  6828. | [58719] Apache Geronimo Keystore Unprivileged Service Disable DoS
  6829. | [58718] Apache Geronimo Deployment Plans Remote Password Disclosure
  6830. | [58717] Apache Jetspeed Portlet Application Edit Access Restriction Bypass
  6831. | [58716] Apache Jetspeed PSML Management Cached Constraint Authentication Weakness
  6832. | [58707] Apache WSS4J Crafted PasswordDigest Request Authentication Bypass
  6833. | [58706] Apache HttpClient Pre-emptive Authorization Remote Credential Disclosure
  6834. | [58705] Apache Directory Server (ApacheDS) User Passwords Cleartext Disclosure
  6835. | [58704] Apache Directory Server (ApacheDS) Non-existent User LDAP Bind Remote DoS
  6836. | [58703] Apache Geronimo Debug Console Unauthenticated Remote Information Disclosure
  6837. | [58702] Apache Directory Server (ApacheDS) Persistent LDAP Anonymous Bind Weakness
  6838. | [58701] Apache Jetspeed User Admin Portlet Unpassworded Account Creation Weakness
  6839. | [58700] Apache MyFaces /faces/* Path Handling Remote Overflow DoS
  6840. | [58699] Apache MyFaces Disable Property Client Side Manipulation Privilege Escalation
  6841. | [58698] Apache Roller Remember Me Functionality Cleartext Password Disclosure
  6842. | [58697] Apache XalanJ2 org.apache.xalan.xsltc.runtime.CallFunction Class Unspecified Issue
  6843. | [58696] Apache Tapestry Encoded Traversal Arbitrary File Access
  6844. | [58695] Apache Jetspeed Unauthenticated PSML Tags / Admin Folder Access
  6845. | [58694] Apache Geronimo Deploy Tool Process List Local Credential Disclosure
  6846. | [58693] Apache Derby service.properties File Encryption Key Information Disclosure
  6847. | [58692] Apache Geronimo Default Security Realm Login Brute Force Weakness
  6848. | [58689] Apache Roller Retrieve Last 5 Post Feature Unauthorized Blog Post Manipulation
  6849. | [58688] Apache Xalan-Java (XalanJ2) Static Variables Multiple Unspecified Issues
  6850. | [58687] Apache Axis Invalid wsdl Request XSS
  6851. | [58686] Apache Cocoon Temporary File Creation Unspecified Race Condition
  6852. | [58685] Apache Velocity Template Designer Privileged Code Execution
  6853. | [58684] Apache Jetspeed controls.Customize Action Security Check Bypass
  6854. | [58675] Apache Open For Business Project (OFBiz) eCommerce/ordermgr Multiple Field XSS
  6855. | [58674] Apache Open For Business Project (OFBiz) ecommerce/control/login Multiple Field XSS
  6856. | [58673] Apache Open For Business Project (OFBiz) ecommerce/control/viewprofile Multiple Field XSS
  6857. | [58672] Apache Open For Business Project (OFBiz) POS Input Panel Cleartext Password Disclosure
  6858. | [58671] Apache Axis2 JMS Signed Message Crafted WS-Security Header Security Bypass
  6859. | [58670] Apache Jetspeed JetspeedTool.getPortletFromRegistry Portlet Security Validation Failure
  6860. | [58669] Apache Jetspeed LDAP Cleartext Passwords Disclosure
  6861. | [58668] Apache Axis External Entity (XXE) Data Parsing Privilege Escalation
  6862. | [58667] Apache Roller Database Cleartext Passwords Disclosure
  6863. | [58666] Apache Xerces-C++ UTF-8 Transcoder Overlong Code Handling Unspecified Issue
  6864. | [58665] Apache Jetspeed Turbine: Cross-user Privileged Action Execution
  6865. | [58664] Apache Jetspeed EditAccount.vm Password Modification Weakness
  6866. | [58663] Apache Jetspeed Role Parameter Arbitrary Portlet Disclosure
  6867. | [58662] Apache Axis JWS Page Generated .class File Direct Request Information Disclosure
  6868. | [58661] Apache Jetspeed user-form.vm Password Reset Cleartext Disclosure
  6869. | [58660] Apache WSS4J checkReceiverResults Function Crafted SOAP Request Authentication Bypass
  6870. | [58658] Apache Rampart Crafted SOAP Request Security Verification Bypass
  6871. | [57882] Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Command Injection
  6872. | [57851] Apache HTTP Server mod_proxy_ftp EPSV Command NULL Dereference Remote DoS
  6873. | [56984] Apache Xerces2 Java Malformed XML Input DoS
  6874. | [56903] Apache ODE (Orchestration Director Engine) Process Deployment Web Service Traversal Arbitrary File Manipulation
  6875. | [56859] Apache Xerces-C++ Multiple Sub-project XML Nested DTD Structures Parsing Recursion Error DoS
  6876. | [56766] Apache Portable Runtime (APR-util) memory/unix/apr_pools.c Relocatable Memory Block Aligning Overflow
  6877. | [56765] Apache Portable Runtime (APR-util) misc/apr_rmm.c Multiple Function Overflows
  6878. | [56517] Apache HTTP Server File Descriptor Leak Arbitrary Local File Append
  6879. | [56443] PTK Unspecified Apache Sub-process Arbitrary Command Execution
  6880. | [56414] Apache Tiles Duplicate Expression Language (EL) Expression Evaluation XSS
  6881. | [55814] mod_NTLM for Apache HTTP Server ap_log_rerror() Function Remote Format String
  6882. | [55813] mod_NTLM for Apache HTTP Server log() Function Remote Overflow
  6883. | [55782] Apache HTTP Server mod_deflate Module Aborted Connection DoS
  6884. | [55553] Apache HTTP Server mod_proxy Module mod_proxy_http.c stream_reqbody_cl Function CPU Consumption DoS
  6885. | [55059] Apache APR-util strmatch/apr_strmatch.c apr_strmatch_precompile Function Crafted Input Remote DoS
  6886. | [55058] Apache APR-util apr_brigade_vprintf Function Crafted Input Off-by-one Remote DoS
  6887. | [55057] Apache APR-util xml/apr_xml.c apr_xml_* Interface Expat XML Parser Crafted XML Document Remote DoS
  6888. | [55056] Apache Tomcat Cross-application TLD File Manipulation
  6889. | [55055] Apache Tomcat Illegal URL Encoded Password Request Username Enumeration
  6890. | [55054] Apache Tomcat Java AJP Connector mod_jk Load Balancing Worker Malformed Header Remote DoS
  6891. | [55053] Apache Tomcat Crafted Request Security Restraint Bypass Arbitrary Content Access
  6892. | [54733] Apache HTTP Server AllowOverride Directive .htaccess Options Bypass
  6893. | [54713] razorCMS Security Manager apache User Account Unspecified File Permission Weakness Issue
  6894. | [54589] Apache Jserv Nonexistent JSP Request XSS
  6895. | [54122] Apache Struts s:a / s:url Tag href Element XSS
  6896. | [54093] Apache ActiveMQ Web Console JMS Message XSS
  6897. | [53932] Apache Geronimo Multiple Admin Function CSRF
  6898. | [53931] Apache Geronimo /console/portal/Server/Monitoring Multiple Parameter XSS
  6899. | [53930] Apache Geronimo /console/portal/ URI XSS
  6900. | [53929] Apache Geronimo on Windows Security/Keystores Portlet Traversal Arbitrary File Upload
  6901. | [53928] Apache Geronimo on Windows Embedded DB/DB Manager Portlet Traversal Arbitrary File Upload
  6902. | [53927] Apache Geronimo on Windows Services/Repository Portlet Traversal Arbitrary File Upload
  6903. | [53921] Apache HTTP Server mod_proxy_ajp Cross Thread/Session Information Disclosure
  6904. | [53766] Oracle BEA WebLogic Server Plug-ins for Apache Certificate Handling Remote Overflow
  6905. | [53574] PHP on Apache .htaccess mbstring.func_overload Setting Cross Hosted Site Behavior Modification
  6906. | [53381] Apache Tomcat JK Connector Content-Length Header Cross-user Information Disclosure
  6907. | [53380] Apache Struts Unspecified XSS
  6908. | [53289] Apache mod_perl Apache::Status /perl-status Unspecified XSS
  6909. | [53186] Apache HTTP Server htpasswd Predictable Salt Weakness
  6910. | [52899] Apache Tomcat Examples Web Application Calendar Application jsp/cal/cal2.jsp time Parameter XSS
  6911. | [52407] Apache Tomcat doRead Method POST Content Information Disclosure
  6912. | [51923] Apache HTTP Server mod-auth-mysql Module mod_auth_mysql.c Multibyte Character Encoding SQL Injection
  6913. | [51613] Apache HTTP Server Third-party Module Child Process File Descriptor Leak
  6914. | [51612] Apache HTTP Server Internal Redirect Handling Infinite Loop DoS
  6915. | [51468] Apache Jackrabbit Content Repository (JCR) swr.jsp q Parameter XSS
  6916. | [51467] Apache Jackrabbit Content Repository (JCR) search.jsp q Parameter XSS
  6917. | [51151] Apache Roller Search Function q Parameter XSS
  6918. | [50482] PHP with Apache php_value Order Unspecified Issue
  6919. | [50475] Novell NetWare ApacheAdmin Console Unauthenticated Access
  6920. | [49734] Apache Struts DefaultStaticContentLoader Class Traversal Arbitrary File Access
  6921. | [49733] Apache Struts FilterDispatcher Class Traversal Arbitrary File Access
  6922. | [49283] Oracle BEA WebLogic Server Plugins for Apache Remote Transfer-Encoding Overflow
  6923. | [49062] Apache Tomcat Cross-thread Concurrent Request Variable Overwrite Information Disclosure
  6924. | [48847] ModSecurity (mod_security) Transformation Caching Unspecified Apache DoS
  6925. | [48788] Apache Xerces-C++ XML Schema maxOccurs Value XML File Handling DoS
  6926. | [47474] Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS
  6927. | [47464] Apache Tomcat allowLinking / UTF-8 Traversal Arbitrary File Access
  6928. | [47463] Apache Tomcat RequestDispatcher Traversal Arbitrary File Access
  6929. | [47462] Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS
  6930. | [47096] Oracle Weblogic Apache Connector POST Request Overflow
  6931. | [46382] Frontend Filemanager (air_filemanager) Extension for TYPO3 on Apache Unspecified Arbitrary Code Execution
  6932. | [46285] TYPO3 on Apache Crafted Filename Upload Arbitrary Command Execution
  6933. | [46085] Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interim Response Forwarding Remote DoS
  6934. | [45905] Apache Tomcat Host Manager host-manager/html/add name Parameter XSS
  6935. | [45879] Ragnarok Online Control Panel on Apache Crafted Traversal Authentication Bypass
  6936. | [45742] Apache HTTP Server on Novell Unspecified Request Directive Internal IP Disclosure
  6937. | [45740] Apache Derby DropSchemaNode Bind Phase Arbitrary Scheme Statement Dropping
  6938. | [45599] Apache Derby Lock Table Statement Privilege Requirement Bypass Arbitrary Table Lock
  6939. | [45585] Apache Derby ACCSEC Command RDBNAM Parameter Cleartext Credential Disclosure
  6940. | [45584] Apache Derby DatabaseMetaData.getURL Function Cleartext Credential Disclosure
  6941. | [45420] Apache HTTP Server 403 Error Page UTF-7 Encoded XSS
  6942. | [44728] PHP Toolkit on Gentoo Linux Interpretation Conflict Apache HTTP Server Local DoS
  6943. | [44618] Oracle JSP Apache/Jserv Path Translation Traversal Arbitrary JSP File Execution
  6944. | [44159] Apache HTTP Server Remote Virtual Host Name Disclosure
  6945. | [43997] Apache-SSL ExpandCert() Function Certificate Handling Arbitrary Environment Variables Manipulation
  6946. | [43994] suPHP for Apache (mod_suphp) Directory Symlink Local Privilege Escalation
  6947. | [43993] suPHP for Apache (mod_suphp) Owner Mode Race Condition Symlink Local Privilege Escalation
  6948. | [43663] Apache HTTP Server Mixed Platform AddType Directive Crafted Request PHP Source Disclosure
  6949. | [43658] AuthCAS Module (AuthCAS.pm) for Apache HTTP Server SESSION_COOKIE_NAME SQL Injection
  6950. | [43452] Apache Tomcat HTTP Request Smuggling
  6951. | [43309] Apache Geronimo LoginModule Login Method Bypass
  6952. | [43290] Apache JSPWiki Entry Page Attachment Unrestricted File Upload
  6953. | [43259] Apache HTTP Server on Windows mod_proxy_balancer URL Handling Remote Memory Corruption
  6954. | [43224] Apache Geronimo on SuSE Linux init Script Symlink Unspecified File/Directory Access
  6955. | [43189] Apache mod_jk2 Host Header Multiple Fields Remote Overflow
  6956. | [42937] Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF
  6957. | [42341] MOD_PLSQL for Apache Unspecified URL SQL Injection
  6958. | [42340] MOD_PLSQL for Apache CGI Environment Handling Unspecified Overflow
  6959. | [42214] Apache HTTP Server mod_proxy_ftp UTF-7 Encoded XSS
  6960. | [42091] Apache Maven Site Plugin Installation Permission Weakness
  6961. | [42089] Apache Maven .m2/settings.xml Cleartext Password Disclosure
  6962. | [42088] Apache Maven Defined Repo Process Listing Password Disclosure
  6963. | [42087] Apache Maven Site Plugin SSH Deployment Permission Setting Weakness
  6964. | [42036] Apache HTTP Server MS-DOS Device Request Host OS Disclosure
  6965. | [41891] BEA WebLogic Apache Beehive NetUI Page Flow Unspecified XSS
  6966. | [41436] Apache Tomcat Native APR Connector Duplicate Request Issue
  6967. | [41435] Apache Tomcat %5C Cookie Handling Session ID Disclosure
  6968. | [41434] Apache Tomcat Exception Handling Subsequent Request Information Disclosure
  6969. | [41400] LimeSurvey save.php Apache Log File PHP Code Injection
  6970. | [41029] Apache Tomcat Calendar Examples Application cal2.jsp Multiple Parameter CSRF
  6971. | [41019] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload XSS
  6972. | [41018] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload CRLF
  6973. | [40853] Apache Tomcat SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) JSESSIONIDSSO Cookie Security Weakness
  6974. | [40264] Apache HTTP Server mod_proxy_balancer balancer_handler Function bb Variable Remote DoS
  6975. | [40263] Apache HTTP Server mod_proxy_balancer balancer-manager Multiple Parameter XSS
  6976. | [40262] Apache HTTP Server mod_status refresh XSS
  6977. | [39833] Apache Tomcat JULI Logging Component catalina.policy Security Bypass
  6978. | [39251] Coppermine Photo Gallery on Apache Multiple File Extension Upload Arbitrary Code Execution
  6979. | [39166] Apache Tomcat on Windows caseSensitive Attribute Mixed Case Request JSP Source Disclosure
  6980. | [39134] Apache mod_imagemap Module Imagemap Unspecified XSS
  6981. | [39133] Apache mod_imap Module Imagemap File Unspecified XSS
  6982. | [39035] Apache Tomcat examples/servlet/CookieExample Multiple Parameter XSS
  6983. | [39003] Apache HTTP Server HTTP Method Header Request Entity Too Large XSS
  6984. | [39000] Apache Tomcat SendMailServlet sendmail.jsp mailfrom Parameter XSS
  6985. | [38939] Apache HTTP Server Prefork MPM Module Array Modification Local DoS
  6986. | [38673] Apache Jakarta Slide WebDAV SYSTEM Request Traversal Arbitrary File Access
  6987. | [38662] Apache Geronimo SQLLoginModule Nonexistent User Authentication Bypass
  6988. | [38661] Apache Geronimo MEJB Unspecified Authentication Bypass
  6989. | [38641] Apache HTTP Server mod_mem_cache recall_headers Function Information Disclosure
  6990. | [38640] Apache HTTP Server suexec Document Root Unauthorized Operations
  6991. | [38639] Apache HTTP Server suexec Multiple Symlink Privilege Escalation
  6992. | [38636] Apache HTTP Server mod_autoindex.c P Variable UTF-7 Charset XSS
  6993. | [38513] BEA WebLogic Server Proxy Plug-in for Apache Protocol Error Handling Remote DoS
  6994. | [38187] Apache Geronimo / Tomcat WebDAV XML SYSTEM Tag Arbitrary File Access
  6995. | [37079] Apache HTTP Server mod_cache cache_util.c Malformed Cache-Control Header DoS
  6996. | [37071] Apache Tomcat Cookie Handling Session ID Disclosure
  6997. | [37070] Apache Tomcat Cookie Handling Quote Delimiter Session ID Disclosure
  6998. | [37052] Apache HTTP Server mod_status mod_status.c Unspecified XSS
  6999. | [37051] Apache HTTP Server mod_proxy modules/proxy/proxy_util.c Crafted Header Remote DoS
  7000. | [37050] Apache HTTP Server Prefork MPM Module Crafted Code Sequence Local DoS
  7001. | [36417] Apache Tomcat Host Manager Servlet html/add Action aliases Parameter XSS
  7002. | [36377] Apache MyFaces Tomahawk JSF Application autoscroll Multiple Script XSS
  7003. | [36080] Apache Tomcat JSP Examples Crafted URI XSS
  7004. | [36079] Apache Tomcat Manager Uploaded Filename XSS
  7005. | [34888] Apache Tomcat Example Calendar Application cal2.jsp time Parameter XSS
  7006. | [34887] Apache Tomcat implicit-objects.jsp Crafted Header XSS
  7007. | [34885] Apache Tomcat on IIS Servlet Engine MS-DOS Device Request DoS
  7008. | [34884] Apache Tomcat on Windows Nonexistent Resource Request Path Disclosure
  7009. | [34883] Apache Tomcat Crafted JSP File Request Path Disclosure
  7010. | [34882] Apache Tomcat Default SSL Ciphersuite Configuration Weakness
  7011. | [34881] Apache Tomcat Malformed Accept-Language Header XSS
  7012. | [34880] Apache Tomcat HTTP/1.1 Connector NULL Byte Request JSP Source Disclosure
  7013. | [34879] Apache Tomcat examples/jsp2/jspx/textRotate.jspx XSS
  7014. | [34878] Apache Tomcat examples/jsp2/el/implicit-objects.jsp XSS
  7015. | [34877] Apache Tomcat JK Web Server Connector (mod_jk) Double Encoded Traversal Arbitrary File Access
  7016. | [34876] Apache HTTP Server ScriptAlias CGI Source Disclosure
  7017. | [34875] Apache Tomcat appdev/sample/web/hello.jsp Multiple Parameter XSS
  7018. | [34874] Apache Tomcat AJP Connector mod_jk ajp_process_callback Remote Memory Disclosure
  7019. | [34873] Apache Stats Variable Extraction _REQUEST Ssuperglobal Array Overwrite
  7020. | [34872] Apache HTTP Server suexec User/Group Combination Weakness Local Privilege Escalation
  7021. | [34769] Apache Tomcat w/ Proxy Module Double Encoded Traversal Arbitrary File Access
  7022. | [34541] mod_perl for Apache HTTP Server RegistryCooker.pm PATH_INFO Crafted URI Remote DoS
  7023. | [34540] mod_perl for Apache HTTP Server PerlRun.pm PATH_INFO Crafted URI Remote DoS
  7024. | [34398] Apache Tomcat mod_jk Invalid Chunked Encoded Body Information Disclosure
  7025. | [34154] Apache Axis Nonexistent Java Web Service Path Disclosure
  7026. | [33855] Apache Tomcat JK Web Server Connector mod_jk.so Long URI Worker Map Remote Overflow
  7027. | [33816] Apache HTTP Server on Debian Linux TTY Local Privilege Escalation
  7028. | [33456] Apache HTTP Server Crafted TCP Connection Range Header DoS
  7029. | [33346] Avaya Multiple Products Apache Tomcat Port Weakness
  7030. | [32979] Apache Java Mail Enterprise Server (JAMES) Phoenix/MX4J Interface Arbitrary User Creation
  7031. | [32978] Apache Java Mail Enterprise Server (JAMES) POP3Server Log File Plaintext Password Disclosure
  7032. | [32724] Apache mod_python _filter_read Freed Memory Disclosure
  7033. | [32723] Apache Tomcat semicolon Crafted Filename Request Forced Directory Listing
  7034. | [32396] Apache Open For Business Project (OFBiz) Ecommerce Component Forum Implementation Message Body XSS
  7035. | [32395] Apache Open For Business Project (OFBiz) Ecommerce Component Form Field Manipulation Privilege Escalation
  7036. | [30354] Linux Subversion libapache2-svn Search Path Subversion Local Privilege Escalation
  7037. | [29603] PHP ini_restore() Apache httpd.conf Options Bypass
  7038. | [29536] Apache Tcl mod_tcl set_var Function Remote Format String
  7039. | [28919] Apache Roller Weblogger Blog Comment Multiple Field XSS
  7040. | [28130] PHP with Apache Mixed Case Method Limit Directive Bypass
  7041. | [27913] Apache HTTP Server on Windows mod_alias URL Validation Canonicalization CGI Source Disclosure
  7042. | [27588] Apache HTTP Server mod_rewrite LDAP Protocol URL Handling Overflow
  7043. | [27487] Apache HTTP Server Crafted Expect Header Cross Domain HTML Injection
  7044. | [26935] FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
  7045. | [26572] Apache Java Mail Enterprise Server (JAMES) MAIL Command Overflow DoS
  7046. | [25909] Drupal on Apache files Directory File Upload Arbitrary Code Execution
  7047. | [24825] Oracle ModPL/SQL for Apache Unspecified Remote HTTP Issue
  7048. | [24365] Apache Struts Multiple Function Error Message XSS
  7049. | [24364] Apache Struts getMultipartRequestHandler() Function Crafted Request DoS
  7050. | [24363] Apache Struts org.apache.struts.taglib.html.Constants.CANCEL Validation Bypass
  7051. | [24103] Pubcookie Apache mod_pubcookie Unspecified XSS
  7052. | [23906] Apache mod_python for Apache HTTP Server FileSession Privileged Local Command Execution
  7053. | [23905] Apache Log4net LocalSyslogAppender Format String Memory Corruption DoS
  7054. | [23198] Apache WSS4J Library SOAP Signature Verification Bypass
  7055. | [23124] Generic Apache Request Library (libapreq) apreq_parse_* Functions Remote DoS
  7056. | [22652] mod_php for Apache HTTP Server Crafted import_request_variables Function DoS
  7057. | [22475] PHP w/ Apache PDO::FETCH_CLASS __set() Function DoS
  7058. | [22473] PHP w/ Apache2 Crafted PDOStatement DoS
  7059. | [22459] Apache Geronimo Error Page XSS
  7060. | [22458] Apache Tomcat / Geronimo Sample Script cal2.jsp time Parameter XSS
  7061. | [22301] auth_ldap for Apache HTTP Server auth_ldap_log_reason() Function Remote Format String
  7062. | [22261] Apache HTTP Server mod_ssl ssl_hook_Access Error Handling DoS
  7063. | [22259] mod_auth_pgsql for Apache HTTP Server Log Function Format String
  7064. | [21736] Apache Java Mail Enterprise Server (JAMES) Spooler retrieve Function DoS
  7065. | [21705] Apache HTTP Server mod_imap Image Map Referer XSS
  7066. | [21021] Apache Struts Error Message XSS
  7067. | [20897] PHP w/ Apache 2 SAPI virtual() Function Unspecified INI Setting Disclosure
  7068. | [20491] PHP mod_php apache2handler SAPI Crafted .htaccess DoS
  7069. | [20462] Apache HTTP Server worker.c MPM Memory Exhaustion DoS
  7070. | [20439] Apache Tomcat Directory Listing Saturation DoS
  7071. | [20373] Apache Tomcat on HP Secure OS for Linux Unspecified Servlet Access Issue
  7072. | [20285] Apache HTTP Server Log File Control Character Injection
  7073. | [20242] Apache HTTP Server mod_usertrack Predictable Session ID Generation
  7074. | [20209] Brainf*ck Module (mod_bf) for Apache HTTP Server Local Overflow
  7075. | [20033] Apache Tomcat MS-DOS Device Request Error Message Path Disclosure
  7076. | [19883] apachetop atop.debug Symlink Arbitrary File Overwrite
  7077. | [19863] mod_auth_shadow for Apache HTTP Server require group Authentication Bypass
  7078. | [19855] Apache HTTP Server ErrorDocument Directive .htaccess Bypass
  7079. | [19821] Apache Tomcat Malformed Post Request Information Disclosure
  7080. | [19769] Apache HTTP Server Double-reverse DNS Lookup Spoofing
  7081. | [19188] Apache HTTP Server mod_ssl SSLVerifyClient Per-location Context Restriction Bypass
  7082. | [19137] Apache HTTP Server on Red Hat Linux Double Slash GET Request Forced Directory Listing
  7083. | [19136] Apache on Mandrake Linux Arbitrary Directory Forced Listing
  7084. | [18977] Apache HTTP Server Crafted HTTP Range Header DoS
  7085. | [18389] Ragnarok Online Control Panel Apache Authentication Bypass
  7086. | [18286] Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow
  7087. | [18233] Apache HTTP Server htdigest user Variable Overfow
  7088. | [17738] Apache HTTP Server HTTP Request Smuggling
  7089. | [16586] Apache HTTP Server Win32 GET Overflow DoS
  7090. | [15889] Apache HTTP Server mod_cgid Threaded MPM CGI Output Misdirection
  7091. | [14896] mod_dav for Apache HTTP Server Remote Null Dereference Child Process Termination
  7092. | [14879] Apache HTTP Server ap_log_rerror Function Error Message Path Disclosure
  7093. | [14770] Apache Tomcat AJP12 Protocol Malformed Packet Remote DoS
  7094. | [14597] Apache Tomcat IntegerOverflow.jsp Test JSP Script Path Disclosure
  7095. | [14596] Apache Tomcat pageSession.jsp Test JSP Script Path Disclosure
  7096. | [14595] Apache Tomcat pageLanguage.jsp Test JSP Script Path Disclosure
  7097. | [14594] Apache Tomcat pageIsThreadSafe.jsp Test JSP Script Path Disclosure
  7098. | [14593] Apache Tomcat pageIsErrorPage.jsp Test JSP Script Path Disclosure
  7099. | [14592] Apache Tomcat pageInvalid.jsp Test JSP Script Path Disclosure
  7100. | [14591] Apache Tomcat pageExtends.jsp Test JSP Script Path Disclosure
  7101. | [14590] Apache Tomcat pageDouble.jsp Test JSP Script Path Disclosure
  7102. | [14589] Apache Tomcat pageAutoFlush.jsp Test JSP Script Path Disclosure
  7103. | [14588] Apache Tomcat extends2.jsp Test JSP Script Path Disclosure
  7104. | [14587] Apache Tomcat extends1.jsp Test JSP Script Path Disclosure
  7105. | [14586] Apache Tomcat comments.jsp Test JSP Script Path Disclosure
  7106. | [14585] Apache Tomcat buffer4.jsp Test JSP Script Path Disclosure
  7107. | [14584] Apache Tomcat buffer3.jsp Test JSP Script Path Disclosure
  7108. | [14583] Apache Tomcat buffer2.jsp Test JSP Script Path Disclosure
  7109. | [14582] Apache Tomcat buffer1.jsp Test JSP Script Path Disclosure
  7110. | [14581] Apache Tomcat pageImport2.jsp Test JSP Script Path Disclosure
  7111. | [14580] Apache Tomcat pageInfo.jsp Test JSP Script Path Disclosure
  7112. | [14410] mod_frontpage for Apache HTTP Server fpexec Remote Overflow
  7113. | [14044] Apache Batik Squiggle Browser with Rhino Scripting Engine Unspecified File System Access
  7114. | [13737] mod_access_referer for Apache HTTP Server Malformed Referer DoS
  7115. | [13711] Apache mod_python publisher.py Traversal Arbitrary Object Information Disclosure
  7116. | [13640] mod_auth_any for Apache HTTP Server on Red Hat Linux Metacharacter Command Execution
  7117. | [13304] Apache Tomcat realPath.jsp Path Disclosure
  7118. | [13303] Apache Tomcat source.jsp Arbitrary Directory Listing
  7119. | [13087] Apache HTTP Server mod_log_forensic check_forensic Symlink Arbitrary File Creation / Overwrite
  7120. | [12849] mod_auth_radius for Apache HTTP Server radcpy() Function Overflow DoS
  7121. | [12848] Apache HTTP Server htdigest realm Variable Overflow
  7122. | [12721] Apache Tomcat examples/jsp2/el/functions.jsp XSS
  7123. | [12720] mod_dosevasive for Apache HTTP Server Symlink Arbitrary File Create/Overwrite
  7124. | [12558] Apache HTTP Server IPv6 FTP Proxy Socket Failure DoS
  7125. | [12557] Apache HTTP Server prefork MPM accept Error DoS
  7126. | [12233] Apache Tomcat MS-DOS Device Name Request DoS
  7127. | [12232] Apache Tomcat with JDK Arbitrary Directory/Source Disclosure
  7128. | [12231] Apache Tomcat web.xml Arbitrary File Access
  7129. | [12193] Apache HTTP Server on Mac OS X File Handler Bypass
  7130. | [12192] Apache HTTP Server on Mac OS X Unauthorized .ht and .DS_Store File Access
  7131. | [12178] Apache Jakarta Lucene results.jsp XSS
  7132. | [12176] mod_digest_apple for Apache HTTP Server on Mac OS X Authentication Replay
  7133. | [11391] Apache HTTP Server Header Parsing Space Saturation DoS
  7134. | [11003] Apache HTTP Server mod_include get_tag() Function Local Overflow
  7135. | [10976] mod_mylo for Apache HTTP Server mylo_log Logging Function HTTP GET Overflow
  7136. | [10637] Apache HTTP Server mod_ssl SSLCipherSuite Access Restriction Bypass
  7137. | [10546] Macromedia JRun4 mod_jrun Apache Module Remote Overflow
  7138. | [10471] Apache Xerces-C++ XML Parser DoS
  7139. | [10218] Apache HTTP Server Satisfy Directive Access Control Bypass
  7140. | [10068] Apache HTTP Server htpasswd Local Overflow
  7141. | [10049] mod_cplusplus For Apache HTTP Server Unspecified Overflow
  7142. | [9994] Apache HTTP Server apr-util IPV6 Parsing DoS
  7143. | [9991] Apache HTTP Server ap_resolve_env Environment Variable Local Overflow
  7144. | [9948] mod_dav for Apache HTTP Server LOCK Request DoS
  7145. | [9742] Apache HTTP Server mod_ssl char_buffer_read Function Reverse Proxy DoS
  7146. | [9718] Apache HTTP Server Win32 Single Dot Append Arbitrary File Access
  7147. | [9717] Apache HTTP Server mod_cookies Cookie Overflow
  7148. | [9716] Apache::Gallery Gallery.pm Inline::C Predictable Filename Code Execution
  7149. | [9715] Apache HTTP Server rotatelogs Control Characters Over Pipe DoS
  7150. | [9714] Apache Authentication Module Threaded MPM DoS
  7151. | [9713] Apache HTTP Server on OS2 filestat.c Device Name Request DoS
  7152. | [9712] Apache HTTP Server Multiple Linefeed Request Memory Consumption DoS
  7153. | [9711] Apache HTTP Server Access Log Terminal Escape Sequence Injection
  7154. | [9710] Apache HTTP Server on Windows Illegal Character Default Script Mapping Bypass
  7155. | [9709] Apache HTTP Server on Windows MS-DOS Device Name HTTP Post Code Execution
  7156. | [9708] Apache HTTP Server on Windows MS-DOS Device Name DoS
  7157. | [9707] Apache HTTP Server Duplicate MIME Header Saturation DoS
  7158. | [9706] Apache Web Server Multiple MIME Header Saturation Remote DoS
  7159. | [9705] Apache Tomcat Invoker/Default Servlet Source Disclosure
  7160. | [9702] Apache HTTP Server CGI/WebDAV HTTP POST Request Source Disclosure
  7161. | [9701] Apache HTTP Server for Windows Multiple Slash Forced Directory Listing
  7162. | [9700] Apache HTTP Server mod_autoindex Multiple Slash Request Forced Directory Listing
  7163. | [9699] Apache HTTP Server mod_dir Multiple Slash Request Forced Directory Listing
  7164. | [9698] Apache HTTP Server mod_negotiation Multiple Slash Request Forced Directory Listing
  7165. | [9697] Apache HTTP Server htdigest Local Symlink Arbitrary File Overwrite
  7166. | [9696] Apache HTTP Server htpasswd Local Symlink Arbitrary File Overwrite
  7167. | [9695] Apache Tomcat SnoopServlet Servlet Information Disclosure
  7168. | [9694] PHP3 on Apache HTTP Server Encoded Traversal Arbitrary File Access
  7169. | [9693] mod_auth_pgsql_sys for Apache HTTP Server User Name SQL Injection
  7170. | [9692] Apache HTTP Server mod_vhost_alias Mass Virtual Hosting Arbitrary File Access
  7171. | [9691] Apache HTTP Server mod_rewrite Mass Virtual Hosting Arbitrary File Access
  7172. | [9690] Apache HTTP Server mod_vhost_alias CGI Program Source Disclosure
  7173. | [9689] Trustix httpsd for Apache-SSL Permission Weakness Privilege Escalation
  7174. | [9688] Apache HTTP Server mod_proxy Malformed FTP Command DoS
  7175. | [9687] Apache::AuthenSmb smbval SMB Authentication Library Multiple Overflows
  7176. | [9686] Apache::AuthenSmb smbvalid SMB Authentication Library Multiple Overflows
  7177. | [9523] Apache HTTP Server mod_ssl Aborted Connection DoS
  7178. | [9459] Oracle PL/SQL (mod_plsql) Apache Module Help Page Request Remote Overflow
  7179. | [9208] Apache Tomcat .jsp Encoded Newline XSS
  7180. | [9204] Apache Tomcat ROOT Application XSS
  7181. | [9203] Apache Tomcat examples Application XSS
  7182. | [9068] Apache HTTP Server mod_userdir User Account Information Disclosure
  7183. | [8773] Apache Tomcat Catalina org.apache.catalina.servlets.DefaultServlet Source Code Disclosure
  7184. | [8772] Apache Tomcat Catalina org.apache.catalina.connector.http DoS
  7185. | [7943] Apache HTTP Server mod_ssl sslkeys File Disclosure
  7186. | [7942] Apache HTTP Server mod_ssl Default Pass Phrase
  7187. | [7941] Apache HTTP Server mod_ssl Encrypted Private Key File Descriptor Leak
  7188. | [7935] Apache HTTP Server mod_ssl ssl_gcache Race Conditions
  7189. | [7934] Apache HTTP Server mod_ssl SSLSessionCache File Content Disclosure
  7190. | [7933] Apache HTTP Server mod_ssl SSLMutex File Content Disclosure
  7191. | [7932] Apache HTTP Server mod_ssl mkcert.sh File Creation Permission Weakness
  7192. | [7931] Apache HTTP Server mod_ssl X.509 Client Certificate Authentication Bypass
  7193. | [7930] Apache HTTP Server mod_ssl ssl_expr_eval_func_file() Overflow
  7194. | [7929] Apache HTTP Server mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String
  7195. | [7611] Apache HTTP Server mod_alias Local Overflow
  7196. | [7394] Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS
  7197. | [7203] Apache Tomcat source.jsp Traversal Arbitrary File Access
  7198. | [7039] Apache HTTP Server on Mac OS X HFS+ File System Access Bypass
  7199. | [6882] Apache mod_python Malformed Query String Variant DoS
  7200. | [6839] Apache HTTP Server mod_proxy Content-Length Overflow
  7201. | [6630] Apache Tomcat Java Server Pages (JSP) Engine WPrinterJob() DoS
  7202. | [6472] Apache HTTP Server mod_ssl ssl_util_uuencode_binary Remote Overflow
  7203. | [5821] Apache HTTP Server Multiple / GET Remote Overflow DoS
  7204. | [5580] Apache Tomcat Servlet Malformed URL JSP Source Disclosure
  7205. | [5552] Apache HTTP Server split-logfile Arbitrary .log File Overwrite
  7206. | [5526] Apache Tomcat Long .JSP URI Path Disclosure
  7207. | [5278] Apache Tomcat web.xml Restriction Bypass
  7208. | [5051] Apache Tomcat Null Character DoS
  7209. | [4973] Apache Tomcat servlet Mapping XSS
  7210. | [4650] mod_gzip for Apache HTTP Server Debug Mode Printf Stack Overflow
  7211. | [4649] mod_gzip for Apache HTTP Server Debug Mode Format String Overflow
  7212. | [4648] mod_gzip for Apache HTTP Server Debug Mode Race Condition
  7213. | [4568] mod_survey For Apache ENV Tags SQL Injection
  7214. | [4553] Apache HTTP Server ApacheBench Overflow DoS
  7215. | [4552] Apache HTTP Server Shared Memory Scoreboard DoS
  7216. | [4446] Apache HTTP Server mod_disk_cache Stores Credentials
  7217. | [4383] Apache HTTP Server Socket Race Condition DoS
  7218. | [4382] Apache HTTP Server Log Entry Terminal Escape Sequence Injection
  7219. | [4340] Apache Portable Runtime (APR) apr_psprintf DoS
  7220. | [4232] Apache Cocoon DatabaseAuthenticatorAction SQL Injection
  7221. | [4231] Apache Cocoon Error Page Server Path Disclosure
  7222. | [4182] Apache HTTP Server mod_ssl Plain HTTP Request DoS
  7223. | [4181] Apache HTTP Server mod_access IP Address Netmask Rule Bypass
  7224. | [4075] Apache HTTP Sever on Windows .var File Request Path Disclosure
  7225. | [4037] Apache HTTP Server on Cygwin Encoded GET Request Arbitrary File Access
  7226. | [3877] Apache-SSL SSLVerifyClient SSLFakeBasicAuth Client Certificate Forgery
  7227. | [3819] Apache HTTP Server mod_digest Cross Realm Credential Replay
  7228. | [3322] mod_php for Apache HTTP Server Process Hijack
  7229. | [3215] mod_php for Apache HTTP Server File Descriptor Leakage
  7230. | [2885] Apache mod_python Malformed Query String DoS
  7231. | [2749] Apache Cocoon view-source Sample File Traversal Arbitrary File Access
  7232. | [2733] Apache HTTP Server mod_rewrite Local Overflow
  7233. | [2672] Apache HTTP Server mod_ssl SSLCipherSuite Ciphersuite Downgrade Weakness
  7234. | [2613] Apache HTTP Server mod_cgi stderr Output Handling Local DoS
  7235. | [2149] Apache::Gallery Privilege Escalation
  7236. | [2107] Apache HTTP Server mod_ssl Host: Header XSS
  7237. | [1926] Apache HTTP Server mod_rewrite Crafted URI Rule Bypass
  7238. | [1833] Apache HTTP Server Multiple Slash GET Request DoS
  7239. | [1577] Apache HTTP Server mod_rewrite RewriteRule Expansion Arbitrary File Access
  7240. | [872] Apache Tomcat Multiple Default Accounts
  7241. | [862] Apache HTTP Server SSI Error Page XSS
  7242. | [859] Apache HTTP Server Win32 Crafted Traversal Arbitrary File Access
  7243. | [849] Apache Tomcat TroubleShooter Servlet Information Disclosure
  7244. | [845] Apache Tomcat MSDOS Device XSS
  7245. | [844] Apache Tomcat Java Servlet Error Page XSS
  7246. | [842] Apache HTTP Server mod_ssl ssl_compat_directive Function Overflow
  7247. | [838] Apache HTTP Server Chunked Encoding Remote Overflow
  7248. | [827] PHP4 for Apache on Windows php.exe Malformed Request Path Disclosure
  7249. | [775] Apache mod_python Module Importing Privilege Function Execution
  7250. | [769] Apache HTTP Server Win32 DOS Batch File Arbitrary Command Execution
  7251. | [756] Apache HTTP Server mod_ssl i2d_SSL_SESSION Function SSL Client Certificate Overflow
  7252. | [701] Apache HTTP Server Win32 ScriptAlias php.exe Arbitrary File Access
  7253. | [674] Apache Tomcat Nonexistent File Error Message Path Disclosure
  7254. | [637] Apache HTTP Server UserDir Directive Username Enumeration
  7255. | [623] mod_auth_pgsql for Apache HTTP Server User Name SQL Injection
  7256. | [582] Apache HTTP Server Multiviews Feature Arbitrary Directory Listing
  7257. | [562] Apache HTTP Server mod_info /server-info Information Disclosure
  7258. | [561] Apache Web Servers mod_status /server-status Information Disclosure
  7259. | [417] Apache HTTP Server on SuSE Linux /doc/packages Remote Information Disclosure
  7260. | [410] mod_perl for Apache HTTP Server /perl/ Directory Listing
  7261. | [404] Apache HTTP Server on SuSE Linux WebDAV PROPFIND Arbitrary Directory Listing
  7262. | [402] Apache HTTP Server on SuSE Linux cgi-bin-sdb Request Script Source Disclosure
  7263. | [379] Apache ASP module Apache::ASP source.asp Example File Arbitrary File Creation
  7264. | [377] Apache Tomcat Snoop Servlet Remote Information Disclosure
  7265. | [376] Apache Tomcat contextAdmin Arbitrary File Access
  7266. | [342] Apache HTTP Server for Windows Multiple Forward Slash Directory Listing
  7267. | [222] Apache HTTP Server test-cgi Arbitrary File Access
  7268. | [143] Apache HTTP Server printenv.pl Multiple Method CGI XSS
  7269. | [48] Apache HTTP Server on Debian /usr/doc Directory Information Disclosure
  7270. |_
  7271. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  7272. Aggressive OS guesses: Linux 3.8 (95%), Linux 2.6.32 (95%), Linux 2.6.32 - 3.10 (95%), Linux 2.6.32 - 3.13 (95%), Linux 2.6.32 - 3.9 (95%), Linux 3.2 (95%), Linux 2.6.32 - 3.1 (94%), Linux 3.11 (94%), Linux 3.5 (94%), Linux 3.1 (94%)
  7273. No exact OS matches for host (test conditions non-ideal).
  7274. Uptime guess: 29.183 days (since Mon Oct 21 13:44:25 2019)
  7275. Network Distance: 14 hops
  7276. TCP Sequence Prediction: Difficulty=258 (Good luck!)
  7277. IP ID Sequence Generation: All zeros
  7278.  
  7279. TRACEROUTE (using port 80/tcp)
  7280. HOP RTT       ADDRESS
  7281. 1   126.37 ms 10.231.200.1
  7282. 2   ...
  7283. 3   126.74 ms te0-0-2-1.nr11.b069785-0.tll01.atlas.cogentco.com (149.6.188.49)
  7284. 4   128.06 ms be2160.rcr51.tll01.atlas.cogentco.com (154.25.10.249)
  7285. 5   138.46 ms be3740.ccr21.sto03.atlas.cogentco.com (154.54.60.190)
  7286. 6   147.97 ms be2204.rcr21.cph01.atlas.cogentco.com (130.117.49.2)
  7287. 7   147.95 ms telia.cph01.atlas.cogentco.com (130.117.14.34)
  7288. 8   253.65 ms kbn-bb3-link.telia.net (80.91.252.22)
  7289. 9   237.69 ms nyk-bb3-link.telia.net (213.155.134.50)
  7290. 10  257.03 ms chi-b21-link.telia.net (80.91.246.162)
  7291. 11  258.23 ms serverhub-ic-324864-chi-b21.c.telia.net (62.115.154.247)
  7292. 12  277.89 ms agg1.c13.r13.s101.chi03.singlehop.net (67.212.190.234)
  7293. 13  261.03 ms aswg1.c03.r13.s101.chi03.singlehop.net (67.212.183.194)
  7294. 14  250.09 ms s11.fcomet.com (184.154.7.82)
  7295.  
  7296. NSE: Script Post-scanning.
  7297. Initiating NSE at 17:08
  7298. Completed NSE at 17:08, 0.00s elapsed
  7299. Initiating NSE at 17:08
  7300. Completed NSE at 17:08, 0.00s elapsed
  7301. ######################################################################################################################################
  7302. Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-19 17:08 EST
  7303. Nmap scan report for s11.fcomet.com (184.154.7.82)
  7304. Host is up (0.25s latency).
  7305.  
  7306. PORT    STATE SERVICE VERSION
  7307. 110/tcp open  pop3    Dovecot pop3d
  7308. | pop3-brute:
  7309. |   Accounts: No valid accounts found
  7310. |   Statistics: Performed 65 guesses in 59 seconds, average tps: 0.9
  7311. |_  ERROR: Failed to connect.
  7312. |_pop3-capabilities: UIDL TOP STLS AUTH-RESP-CODE USER PIPELINING CAPA SASL(PLAIN LOGIN) RESP-CODES
  7313. | vulscan: VulDB - https://vuldb.com:
  7314. | [139289] cPanel up to 68.0.14 dovecot-xaps-plugin Format privilege escalation
  7315. | [134480] Dovecot up to 2.3.5.2 Submission-Login Crash denial of service
  7316. | [134479] Dovecot up to 2.3.5.2 IMAP Server Crash denial of service
  7317. | [134024] Dovecot up to 2.3.5.1 JSON Encoder Username Crash denial of service
  7318. | [132543] Dovecot up to 2.2.36.0/2.3.4.0 Certificate Impersonation weak authentication
  7319. | [119762] Dovecot up to 2.2.28 dict Authentication var_expand() denial of service
  7320. | [114012] Dovecot up to 2.2.33 TLS SNI Restart denial of service
  7321. | [114009] Dovecot SMTP Delivery Email Message Out-of-Bounds memory corruption
  7322. | [112447] Dovecot up to 2.2.33/2.3.0 SASL Auth Memory Leak denial of service
  7323. | [106837] Dovecot up to 2.2.16 ssl-proxy-openssl.c ssl-proxy-opensslc denial of service
  7324. | [97052] Dovecot up to 2.2.26 auth-policy Unset Crash denial of service
  7325. | [69835] Dovecot 2.2.0/2.2.1 denial of service
  7326. | [13348] Dovecot up to 1.2.15/2.1.15 IMAP4/POP3 SSL/TLS Handshake denial of service
  7327. | [65684] Dovecot up to 2.2.6 unknown vulnerability
  7328. | [9807] Dovecot up to 1.2.7 on Exim Input Sanitizer privilege escalation
  7329. | [63692] Dovecot up to 2.0.15 spoofing
  7330. | [7062] Dovecot 2.1.10 mail-search.c denial of service
  7331. | [57517] Dovecot up to 2.0.12 Login directory traversal
  7332. | [57516] Dovecot up to 2.0.12 Access Restriction directory traversal
  7333. | [57515] Dovecot up to 2.0.12 Crash denial of service
  7334. | [54944] Dovecot up to 1.2.14 denial of service
  7335. | [54943] Dovecot up to 1.2.14 Access Restriction Symlink privilege escalation
  7336. | [54942] Dovecot up to 2.0.4 Access Restriction denial of service
  7337. | [54941] Dovecot up to 2.0.4 Access Restriction unknown vulnerability
  7338. | [54840] Dovecot up to 1.2.12 AGate unknown vulnerability
  7339. | [53277] Dovecot up to 1.2.10 denial of service
  7340. | [50082] Dovecot up to 1.1.6 Stack-based memory corruption
  7341. | [45256] Dovecot up to 1.1.5 directory traversal
  7342. | [44846] Dovecot 1.1.4/1.1.5 IMAP Client Crash denial of service
  7343. | [44546] Dovecot up to 1.0.x Access Restriction unknown vulnerability
  7344. | [44545] Dovecot up to 1.0.x Access Restriction unknown vulnerability
  7345. | [41430] Dovecot 1.0.12/1.1 Locking unknown vulnerability
  7346. | [40356] Dovecot 1.0.9 Cache unknown vulnerability
  7347. | [38222] Dovecot 1.0.2 directory traversal
  7348. | [36376] Dovecot up to 1.0.x directory traversal
  7349. | [33332] Timo Sirainen Dovecot up to 1.0test53 Off-By-One memory corruption
  7350. |
  7351. | MITRE CVE - https://cve.mitre.org:
  7352. | [CVE-2011-4318] Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
  7353. | [CVE-2011-2167] script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.
  7354. | [CVE-2011-2166] script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script.
  7355. | [CVE-2011-1929] lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.
  7356. | [CVE-2010-4011] Dovecot in Apple Mac OS X 10.6.5 10H574 does not properly manage memory for user names, which allows remote authenticated users to read the private e-mail of other persons in opportunistic circumstances via standard e-mail clients accessing a user's own mailbox, related to a "memory aliasing issue."
  7357. | [CVE-2010-3780] Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions.
  7358. | [CVE-2010-3779] Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.
  7359. | [CVE-2010-3707] plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
  7360. | [CVE-2010-3706] plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
  7361. | [CVE-2010-3304] The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
  7362. | [CVE-2010-0745] Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message.
  7363. | [CVE-2010-0535] Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos is enabled, does not properly enforce the service access control list (SACL) for sending and receiving e-mail, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
  7364. | [CVE-2010-0433] The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.
  7365. | [CVE-2009-3897] Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.
  7366. | [CVE-2009-3235] Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.
  7367. | [CVE-2009-2632] Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.
  7368. | [CVE-2008-5301] Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.
  7369. | [CVE-2008-4907] The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."
  7370. | [CVE-2008-4870] dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
  7371. | [CVE-2008-4578] The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
  7372. | [CVE-2008-4577] The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
  7373. | [CVE-2008-1218] Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.
  7374. | [CVE-2008-1199] Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
  7375. | [CVE-2007-6598] Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
  7376. | [CVE-2007-5794] Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
  7377. | [CVE-2007-4211] The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.
  7378. | [CVE-2007-2231] Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.
  7379. | [CVE-2007-2173] Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable.
  7380. | [CVE-2007-0618] Unspecified vulnerability in (1) pop3d, (2) pop3ds, (3) imapd, and (4) imapds in IBM AIX 5.3.0 has unspecified impact and attack vectors, involving an "authentication vulnerability."
  7381. | [CVE-2006-5973] Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.
  7382. | [CVE-2006-2502] Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute arbitrary code via a long USER command.
  7383. | [CVE-2006-2414] Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
  7384. | [CVE-2006-0730] Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login.  NOTE: vector 2 might be related to a double free vulnerability.
  7385. | [CVE-2002-0925] Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command to mmftpd 0.0.7 and earlier.
  7386. | [CVE-2001-0143] vpop3d program in linuxconf 1.23r and earlier allows local users to overwrite arbitrary files via a symlink attack.
  7387. | [CVE-2000-1197] POP2 or POP3 server (pop3d) in imap-uw IMAP package on FreeBSD and other operating systems creates lock files with predictable names, which allows local users to cause a denial of service (lack of mail access) for other users by creating lock files for other mail boxes.
  7388. | [CVE-1999-1445] Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords.
  7389. |
  7390. | SecurityFocus - https://www.securityfocus.com/bid/:
  7391. | [103201] Dovecot CVE-2017-14461 Out-Of-Bounds Read Information Disclosure Vulnerability
  7392. | [97536] Dovecot CVE-2017-2669 Denial of Service Vulnerability
  7393. | [94639] Dovecot Auth Component CVE-2016-8652 Denial of Service Vulnerability