All CVEs — page 357 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
An improper privilege management vulnerability allows authenticated users with limited privileges to execute unauthorized commands, leading to potential privilege escalation.
This flaw allows an attacker to navigate a frame to a specific path, enabling the proxy to fetch an attacker-selected URL and access same-origin storage and cookies, posing a significant risk to application security.
Zod's array validation logic fails to limit memory usage when processing large arrays without length constraints, leading to excessive memory allocation and potential application crashes from out-of-memory conditions.
This vulnerability allows authenticated users with low-level Viewer permissions to access sensitive data such as host root passwords through template preview endpoints. It can also lead to arbitrary command execution if Safemode protections are disabled.
The flaw allows an authenticated attacker with low-level permissions to execute arbitrary commands on the hosting server by bypassing the safemode sandbox within the templating engine.
This flaw involves an integer overflow in the mod_dav_fs module of Apache HTTP Server versions up to 2.4.68, allowing authenticated users with write access to crash worker processes and corrupt directory property databases through malicious PROPPATCH requests.
The flaw allows a man-in-the-middle attacker to bypass authentication by replaying captured digest credentials, posing a significant security risk.
This vulnerability allows attackers to manipulate HTTP request and response handling in Apache servers using mod_proxy_uwsgi, potentially leading to response smuggling where crafted uwsgi responses can be interpreted inconsistently by the server. This creates a high-risk scenario for data integrity and can enable further attacks through manipulated HTTP communications.
A NULL pointer dereference vulnerability in Apache HTTP Server's mod_xml2enc module allows untrusted backend servers to trigger a denial of service condition when processing proxied responses with problematic charset conversions. This can lead to server crashes and unavailability.
A stack-based buffer overflow in Apache's mod_vhost_alias module allows remote attackers to cause denial of service or potentially execute arbitrary code when processing HTTP requests with oversized Host headers. This occurs specifically when VirtualDocumentRoot uses hostname format specifiers and the LimitRequestFieldSize is increased above default values.
The flaw allows an untrusted FTP server to trick the Apache HTTP Server proxy into connecting to any third-party host, potentially enabling man-in-the-middle attacks or data exfiltration. This affects forward proxy configurations where the server acts as a gateway for FTP traffic.
This flaw allows attackers to gain elevated privileges by manipulating SSLRequire directives, potentially leading to unauthorized access to sensitive resources.
Apache HTTP Server on Windows contains an out-of-bounds write vulnerability when processing file paths with 8.3 names that can expand. This flaw allows attackers to write beyond allocated memory boundaries, potentially leading to arbitrary code execution or denial of service.