Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Core Services Subscriptions
Total 28 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-9788 6 Apache, Apple, Debian and 3 more 16 Http Server, Mac Os X, Debian Linux and 13 more 2023-11-07 N/A
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
CVE-2017-3167 6 Apache, Apple, Debian and 3 more 15 Http Server, Mac Os X, Debian Linux and 12 more 2023-11-07 9.8 Critical
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
CVE-2017-12613 3 Apache, Debian, Redhat 11 Portable Runtime, Debian Linux, Enterprise Linux Desktop and 8 more 2023-11-07 7.1 High
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
CVE-2016-9596 2 Redhat, Xmlsoft 2 Jboss Core Services, Libxml2 2023-11-07 6.5 Medium
libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.
CVE-2016-8743 4 Apache, Debian, Netapp and 1 more 12 Http Server, Debian Linux, Clustered Data Ontap and 9 more 2023-11-07 7.5 High
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
CVE-2016-5387 8 Apache, Canonical, Debian and 5 more 21 Http Server, Ubuntu Linux, Debian Linux and 18 more 2023-11-07 8.1 High
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
CVE-2021-3541 4 Netapp, Oracle, Redhat and 1 more 27 Active Iq Unified Manager, Cloud Backup, Clustered Data Ontap and 24 more 2022-03-01 6.5 Medium
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2016-9598 2 Redhat, Xmlsoft 2 Jboss Core Services, Libxml2 2020-11-16 6.5 Medium
libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.