Skip to content
Fencer Intel

All · Apache HTTP Server

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2017-9789 When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has bee…
    Apache HTTP Server
    EPSS 9.5% chance of exploitation in 30 days, percentile 95%
  2. 9.1
    CVE-2017-9788 In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not init…
    Apache HTTP Server
    EPSS 56.8% chance of exploitation in 30 days, percentile 99%
  3. 9.8
    CVE-2017-7679 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious C…
    Apache HTTP Server
    EPSS 39.3% chance of exploitation in 30 days, percentile 98%
  4. 7.5
    CVE-2017-7668 The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token(…
    Apache HTTP Server
    EPSS 57.5% chance of exploitation in 30 days, percentile 99%
  5. 9.8
    CVE-2017-3169 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_p…
    Apache HTTP Server
    EPSS 20.0% chance of exploitation in 30 days, percentile 97%
  6. 9.8
    CVE-2017-3167 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authen…
    Apache HTTP Server
    EPSS 20.2% chance of exploitation in 30 days, percentile 97%
  7. 7.5
    CVE-2016-8740 The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restric…
    Apache HTTP Server
    1 public exploit EPSS 79.1% chance of exploitation in 30 days, percentile 99.6%
  8. 8.1
    CVE-2016-5387 The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untr…
    Apache HTTP Server
    EPSS 55.7% chance of exploitation in 30 days, percentile 99%
  9. 7.5
    CVE-2016-4979 The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requ…
    Apache HTTP Server
    EPSS 18.8% chance of exploitation in 30 days, percentile 97%
  10. 5.9
    CVE-2016-1546 The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single…
    Apache HTTP Server
    EPSS 15.9% chance of exploitation in 30 days, percentile 96%
  11. 4.3
    CVE-2015-3185 The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require direc…
    Apache HTTP Server
    EPSS 16.3% chance of exploitation in 30 days, percentile 97%
  12. 5.0
    CVE-2015-3183 The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remo…
    Apache HTTP Server
    EPSS 74.4% chance of exploitation in 30 days, percentile 99.4%
  13. 5.0
    CVE-2015-0253 The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, whi…
    Apache HTTP Server
    EPSS 12.8% chance of exploitation in 30 days, percentile 96%
  14. 5.0
    CVE-2015-0228 The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to…
    Apache HTTP Server
    EPSS 16.9% chance of exploitation in 30 days, percentile 97%
  15. 4.3
    CVE-2014-8109 mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which t…
    Apache HTTP Server
    EPSS 22.0% chance of exploitation in 30 days, percentile 97%
  16. 5.0
    CVE-2014-3583 The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers…
    Apache HTTP Server
    EPSS 10.8% chance of exploitation in 30 days, percentile 95%
  17. 5.0
    CVE-2014-3581 The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows r…
    Apache HTTP Server
    EPSS 13.5% chance of exploitation in 30 days, percentile 96%
  18. 5.0
    CVE-2014-3523 Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Wind…
    Apache HTTP Server
    EPSS 16.8% chance of exploitation in 30 days, percentile 97%
  19. 5.0
    CVE-2014-0231 The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a den…
    Apache HTTP Server
    EPSS 44.7% chance of exploitation in 30 days, percentile 98%
  20. 6.8
    CVE-2014-0226 Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-…
    Apache HTTP Server
    1 public exploit EPSS 85.8% chance of exploitation in 30 days, percentile 99.7%
  21. 4.3
    CVE-2014-0118 The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decomp…
    Apache HTTP Server
    EPSS 37.3% chance of exploitation in 30 days, percentile 98%
  22. 4.3
    CVE-2014-0117 The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a den…
    Apache HTTP Server
    EPSS 35.7% chance of exploitation in 30 days, percentile 98%
  23. 4.3
    CVE-2013-4352 The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forw…
    Apache HTTP Server
    EPSS 11.5% chance of exploitation in 30 days, percentile 96%
  24. 5.0
    CVE-2013-5704 The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a hea…
    Apache HTTP Server
    EPSS 58.0% chance of exploitation in 30 days, percentile 99.1%
  25. 5.0
    CVE-2014-0098 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to…
    Apache HTTP Server
    EPSS 26.7% chance of exploitation in 30 days, percentile 98%
  26. 5.0
    CVE-2013-6438 The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitesp…
    Apache HTTP Server
    EPSS 27.5% chance of exploitation in 30 days, percentile 98%
  27. 7.5
    CVE-2013-2249 mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without…
    Apache HTTP Server
    EPSS 14.6% chance of exploitation in 30 days, percentile 96%
  28. 4.3
    CVE-2013-1896 mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attacke…
    Apache HTTP Server
    EPSS 29.5% chance of exploitation in 30 days, percentile 98%
  29. 5.1
    CVE-2013-1862 mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-prin…
    Apache HTTP Server
    EPSS 24.9% chance of exploitation in 30 days, percentile 97%
  30. 4.3
    CVE-2012-4558 Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in th…
    Apache HTTP Server
    EPSS 22.9% chance of exploitation in 30 days, percentile 97%