| CVE-2025-66200 |
|
Medium |
Dec 05, 2025 |
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htacc
more...
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.
This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
less...
|
2.4.65, 2.4.64, 2.4.63, 2.4.62, 2.4.61, 2.4.60, 2.4.59, 2.4.58, 2.4.57, 2.4.55
|
| CVE-2025-65082 |
|
Medium |
Dec 05, 2025 |
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache conf
more...
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.
This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
Users are recommended to upgrade to version 2.4.66 which fixes the issue.
less...
|
2.4.65, 2.4.64, 2.4.63, 2.4.62, 2.4.61, 2.4.60, 2.4.59, 2.4.58, 2.4.57, 2.4.55
|
| CVE-2025-59775 |
|
High |
Dec 05, 2025 |
Server-Side Request Forgery (SSRF) vulnerability
in Apache HTTP Server on Windows
with AllowEncodedSlashes On and MergeSlashes Off allows to pote
more...
Server-Side Request Forgery (SSRF) vulnerability
in Apache HTTP Server on Windows
with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM
hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
less...
|
2.4.65, 2.4.64, 2.4.63, 2.4.62, 2.4.61, 2.4.60, 2.4.59, 2.4.58, 2.4.57, 2.4.55
|
| CVE-2025-58098 |
|
High |
Dec 05, 2025 |
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #
more...
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.
This issue affects Apache HTTP Server before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
less...
|
2.4.65, 2.4.64, 2.4.63, 2.4.62, 2.4.61, 2.4.60, 2.4.59, 2.4.58, 2.4.57, 2.4.55
|
| CVE-2025-55753 |
|
High |
Dec 05, 2025 |
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backo
more...
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.
This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
less...
|
2.4.65, 2.4.64, 2.4.63, 2.4.62, 2.4.61, 2.4.60, 2.4.59, 2.4.58, 2.4.57, 2.4.55
|