All CVEs — page 358 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A Use After Free vulnerability in Apache HTTP Server's mod_http2 allows attackers to execute arbitrary code by re-entrantly accessing freed memory via shared session->bbtmp.
Apache HTTP Server's mod_proxy_html module contains an out-of-bounds write vulnerability that can be triggered by processing crafted HTTP response bodies. This flaw allows attackers to write data beyond the allocated buffer boundaries, potentially leading to memory corruption and arbitrary code execution in the context of the web server process.
A Use After Free vulnerability in mod_rewrite of Apache HTTP Server allows attackers to execute arbitrary code by manipulating lookahead patterns, leading to a critical security risk.
Apache HTTP Server's mod_charset_lite module contains an out-of-bounds write vulnerability that could allow attackers to write data beyond the allocated memory buffer. This flaw is particularly concerning because it can lead to arbitrary code execution or denial of service when processing specially crafted charset conversion requests.
The flaw allows unauthenticated attackers to trigger forced re-authentication in Apache HTTP Server's Digest authentication mechanism, leading to denial of service. This occurs when AuthDigestNcCheck is enabled, making the server vulnerable to forged Authorization headers that cause unnecessary authentication cycles.
The flaw involves an integer overflow in the sprintf() function, leading to potential buffer overflow. This can allow attackers to inject malicious code or cause a denial of service.
The flaw in Foreman allows for Server-Side Template Injection (SSTI) and insecure deserialization, leading to potential remote code execution and total infrastructure compromise.
The flaw allows OS command injection through the foreman-rake db:dump and db:import_dump tasks, enabling attackers to execute arbitrary shell commands with the permissions of the application.
The flaw allows an attacker with sudo permissions to inject shell commands, leading to the execution of arbitrary code.
Foreman's unattended provisioning API endpoint allows attackers to bypass authentication by accessing kickstart templates without providing a valid provisioning token, even though the system only checks the database state of the token rather than its presence in the HTTP request.
The flaw allows command injection when the effective_user property is marked as overridable, enabling attackers to execute arbitrary shell commands with the privileges of the execution user.
Fortra BoKS Manager has an out-of-bounds read vulnerability in its TLS ClientHello parser that can cause the boks_portmux daemon to crash and restart, leading to service interruption. This allows remote attackers to disrupt the service without authentication.
The flaw allows session cookies to be passed to backend servers even when they should be removed during internal redirects, potentially exposing sensitive session data to unauthorized actors. This affects Apache HTTP Server versions 2.4.0 through 2.4.68.
A NULL pointer dereference vulnerability in Apache HTTP Server's mod_heartmonitor module allows attackers to cause the server to crash via an unicast listener, leading to a denial of service condition. This affects versions 2.4.0 through 2.4.68 and can be exploited by sending specially crafted requests to the heartmonitor endpoint.