56.705 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
Ricerca: http
2706 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2024-20440 | HIGH 7.5 | cisco smart_license_utility A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a | 51,9% | — |
| CVE-2021-31618 | HIGH 7.5 | apache http_server Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the | 51,5% | — |
| CVE-2009-1536 | LOW 2.6 | microsoft .net_framework ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series o | 51,3% | — |
| CVE-2020-11998 | CRIT 9.8 | apache activemq A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.ora | 51,2% | — |
| CVE-2018-11763 | MED 5.9 | apache http_server In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to | 51,0% | — |
| CVE-2000-0869 | MED 5.0 | apache http_server The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method. | 50,9% | — |
| CVE-2016-5388 | HIGH 8.1 | apache tomcat Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might | 50,9% | — |
| CVE-2011-3639 | MED 4.3 | apache http_server The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a rever | 50,6% | — |
| CVE-2022-23943 | CRIT 9.8 | apache http_server Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions. | 50,4% | — |
| CVE-2020-17518 | HIGH 7.5 | apache flink Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users | 50,0% | — |
| CVE-2023-28709 | HIGH 7.5 | apache tomcat The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query str | 49,9% | — |
| CVE-2016-6909 | CRIT 9.8 | fortinet fortios Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER. | 49,9% | — |
| CVE-2026-23918 | HIGH 8.8 | apache http_server Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. | 49,7% | — |
| CVE-2002-0150 | HIGH 7.5 | microsoft internet_information_server Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. | 49,5% | — |
| CVE-2020-13950 | HIGH 7.5 | apache http_server Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service | 49,4% | — |
| CVE-2022-24760 | CRIT 10.0 | parseplatform parse-server Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that | 49,1% | — |
| CVE-2016-0736 | HIGH 7.5 | apache http_server In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. | 49,0% | — |
| CVE-2022-20828 | MED 6.5 | cisco asa_firepower A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER mod | 48,3% | — |
| CVE-2020-13933 | HIGH 7.5 | apache shiro Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. | 48,0% | — |
| CVE-2022-35748 | HIGH 7.5 | microsoft windows_server_2012 HTTP.sys Denial of Service Vulnerability | 47,2% | — |
| CVE-2018-16843 | HIGH 7.5 | apple xcode nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'l | 47,1% | — |
| CVE-2000-0505 | MED 5.0 | apache http_server The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters. | 46,7% | — |
| CVE-2007-5000 | MED 4.3 | apache http_server Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitra | 46,6% | — |
| CVE-2019-15276 | MED 6.5 | cisco wireless_lan_controller_software A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HTT | 46,3% | — |
| CVE-2008-1446 | HIGH 9.0 | microsoft internet_information_services Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute | 46,3% | — |