Vcl (Apache) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 23 known versions, newest CVE from 2025-03-25. Vendor: Apache.

CVEs of Vcl

• CVE-2024-53679 - CVSS 8.4 (high), 2025-03-25: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with…
• CVE-2024-53678 - CVSS 8.8 (high), 2025-03-25: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when…
• CVE-2018-11774 - CVSS 7.2 (high), 2019-07-29: Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL…
• CVE-2018-11773 - CVSS 9.8 (critical), 2019-07-29: Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an…
• CVE-2018-11772 - CVSS 7.2 (high), 2019-07-29: Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree.…
• CVE-2013-0267 - CVSS 8.8 (high), 2018-02-21: The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with…