Vulnerabilities > Apache
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-03-26 | CVE-2012-0256 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Apache Traffic Server Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header. | 5.0 |
| 2012-03-23 | CVE-2012-1089 | Path Traversal vulnerability in Apache Wicket Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package. | 5.0 |
| 2012-03-23 | CVE-2012-0047 | Cross-Site Scripting vulnerability in Apache Wicket Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter. | 4.3 |
| 2012-03-19 | CVE-2012-1181 | Buffer Errors vulnerability in Apache MOD Fcgid 2.3.6 fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit. | 5.0 |
| 2012-03-02 | CVE-2012-0838 | Improper Input Validation vulnerability in Apache Struts Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field. | 10.0 |
| 2012-02-07 | CVE-2012-1007 | Cross-Site Scripting vulnerability in Apache Struts 1.3.10 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do. | 4.3 |
| 2012-02-07 | CVE-2012-1006 | Cross-Site Scripting vulnerability in Apache Struts 2.0.14/2.2.3 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders. | 4.3 |
| 2012-01-19 | CVE-2011-3375 | Information Exposure vulnerability in Apache Tomcat Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data. | 5.0 |
| 2012-01-08 | CVE-2011-5057 | Permissions, Privileges, and Access Controls vulnerability in Apache Struts Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. | 5.0 |
| 2012-01-08 | CVE-2012-0393 | Permissions, Privileges, and Access Controls vulnerability in Apache Struts The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. | 6.4 |