CVE Vulnerability Catalog

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, the HTTP request module incorrectly parses folded headers in HTTP responses, which may lead to misinterpreting the response and using incorrect MIME headers.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.

Libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

Incomplete fix for CVE-2022-31629 in PHP. Network or same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.

In less through version 653, improper quoting in filename.c allows OS command execution via a newline character in a file name. Exploitation typically requires attacker-controlled file names, such as from untrusted archives.