Apache Http Server (Apache) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2024-07-18. Vendor: Apache.

CVEs of Apache Http Server

• CVE-2024-40898 - CVSS 9.1 (critical), 2024-07-18: SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and…
• CVE-2020-1927 - CVSS 6.1 (medium), 2020-04-02: In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…
• CVE-2020-1934 - CVSS 5.3 (medium), 2020-04-01: In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
• CVE-2019-0211 - CVSS 7.8 (high), 2019-04-08: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads…
• CVE-2019-0217 - CVSS 7.5 (high), 2019-04-08: In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid…
• CVE-2019-0215 - CVSS 7.5 (high), 2019-04-08: In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client…
• CVE-2010-1151 - CVSS 6.8 (medium), 2010-04-20: Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data,…