{
  "scan_id": 1770860457,
  "ip": "182.48.57.47",
  "is_ipv4": true,
  "is_ipv6": false,
  "location": {
    "network": "182.48.0.0/18",
    "postal_code": "",
    "coordinates": {
      "latitude": "35.69",
      "longitude": "139.69"
    },
    "geo_point": "35.69, 139.69",
    "locale_code": "en",
    "continent": "Asia",
    "country_code": "JP",
    "country_name": "Japan",
    "city": ""
  },
  "location_updated_at": "2026-02-10T16:41:59Z",
  "asn": {
    "number": "AS9371",
    "organization": "SAKURA Internet Inc.",
    "country_code": ""
  },
  "asn_updated_at": "0001-01-01T00:00:00Z",
  "whois": {
    "network": "182.48.0.0/18",
    "organization": "SAKURA Internet Inc.",
    "descr": "SAKURA Internet Inc.",
    "_encoding": {
      "raw": "BASE64"
    }
  },
  "whois_updated_at": "2024-12-10T12:44:28Z",
  "tags": [
    {
      "name": "is_anonymous_proxy",
      "pretty_name": "Anonymous Proxy",
      "value": false,
      "last_updated_at": "2026-02-10T16:41:59Z"
    },
    {
      "name": "is_cdn",
      "pretty_name": "CDN",
      "value": false,
      "last_updated_at": "2026-02-10T18:21:20Z"
    },
    {
      "name": "is_satellite_provider",
      "pretty_name": "Satellite Provider",
      "value": false,
      "last_updated_at": "2026-02-10T16:41:59Z"
    }
  ],
  "hostnames": [
    {
      "name": "www16253u.sakura.ne.jp",
      "last_updated_at": "2026-02-10T18:21:20Z"
    }
  ],
  "services": [
    {
      "port": 22,
      "protocol": "tcp",
      "name": "ssh",
      "version": "4.3",
      "product": "OpenSSH",
      "extra_info": "protocol 2.0",
      "tunnel": "",
      "softwares": [
        {
          "uri": "cpe:/a:openbsd:openssh:4.3",
          "part": "a",
          "vendor": "openbsd",
          "product": "openssh",
          "version": "4\\.3",
          "language": "ANY",
          "edition": "ANY",
          "update": "ANY"
        }
      ],
      "modules": {
        "ssh": {
          "banner": "SSH-2.0-OpenSSH_4.3",
          "client_to_server_ciphers": [
            "aes128-cbc",
            "3des-cbc",
            "blowfish-cbc",
            "cast128-cbc",
            "arcfour128",
            "arcfour256",
            "arcfour",
            "aes192-cbc",
            "aes256-cbc",
            "[email protected]",
            "aes128-ctr",
            "aes192-ctr",
            "aes256-ctr"
          ],
          "client_to_server_compression": [
            "none",
            "[email protected]"
          ],
          "client_to_server_macs": [
            "hmac-md5",
            "hmac-sha1",
            "hmac-ripemd160",
            "[email protected]",
            "hmac-sha1-96",
            "hmac-md5-96"
          ],
          "host_key_algorithms": [
            "ssh-rsa",
            "ssh-dss"
          ],
          "kex_algorithms": [
            "diffie-hellman-group-exchange-sha1",
            "diffie-hellman-group14-sha1",
            "diffie-hellman-group1-sha1"
          ],
          "key": {
            "algorithm": "ssh-rsa",
            "fingerprint_sha256": "095f6abcfd8d99062d72871828f04716fb22675a35fd84d5b1fbfaf535a26aa7",
            "raw": "AAAAB3NzaC1yc2EAAAABIwAAAQEA08nJoLJGWSXne3w28DNjuvgMfpYbdxtnsE1Ix/164efHOqyz8dhYNJlrRp3vL5iTdn6228esDX6+DCYhiO23BTlY8n2xnf/udyrGlXCuBiG4dZwgG6fAfTBaqzPaQZLc/gEHD+UBG5sprFrWO9jucxLl1gWAGgqwDkjKL/fr9T65qK/U5/GsaOIOL1Cl+J1e9+L98EaM3CqZ7Fx+yDdibCeqzkCYGNiemXLU8AFRgnxy0n0AR5ZuS4UZFnBY7TsmRMgwUUU014SQEVzzhGrorAl2OkNZnuTSe4E1vxQJWiMgdmp9wmcw6XfdbFrKA7a4CHqKkCzr3aXg9cLPU/+/FQ=="
          },
          "server_to_client_ciphers": [
            "aes128-cbc",
            "3des-cbc",
            "blowfish-cbc",
            "cast128-cbc",
            "arcfour128",
            "arcfour256",
            "arcfour",
            "aes192-cbc",
            "aes256-cbc",
            "[email protected]",
            "aes128-ctr",
            "aes192-ctr",
            "aes256-ctr"
          ],
          "server_to_client_compression": [
            "none",
            "[email protected]"
          ],
          "server_to_client_macs": [
            "hmac-md5",
            "hmac-sha1",
            "hmac-ripemd160",
            "[email protected]",
            "hmac-sha1-96",
            "hmac-md5-96"
          ],
          "software": "OpenSSH_4.3",
          "version": "2.0"
        }
      },
      "cve": [
        {
          "id": "CVE-2006-4924",
          "score": 7.8,
          "severity": "high"
        },
        {
          "id": "CVE-2006-5051",
          "score": 8.1,
          "severity": "high"
        },
        {
          "id": "CVE-2006-5052",
          "score": 5,
          "severity": "medium"
        }
      ],
      "_meta": {
        "name": "",
        "desc": "",
        "category": ""
      },
      "last_updated_at": "2026-02-10T00:46:27.902Z"
    },
    {
      "port": 25,
      "protocol": "tcp",
      "name": "smtp",
      "version": "",
      "product": "Postfix smtpd",
      "extra_info": "",
      "tunnel": "",
      "softwares": [
        {
          "uri": "cpe:/a:postfix:postfix",
          "part": "a",
          "vendor": "postfix",
          "product": "postfix",
          "version": "ANY",
          "language": "ANY",
          "edition": "ANY",
          "update": "ANY"
        }
      ],
      "modules": {
        "smtp": {
          "banner": "220 mail.happyhappy.donuthole.org ESMTP unknown\r\n"
        }
      },
      "_meta": {
        "name": "",
        "desc": "",
        "category": ""
      },
      "last_updated_at": "2026-02-11T23:35:26.944Z"
    },
    {
      "port": 80,
      "protocol": "tcp",
      "name": "http",
      "version": "2.2.3",
      "product": "Apache httpd",
      "extra_info": "",
      "tunnel": "",
      "softwares": [
        {
          "uri": "cpe:/a:apache:http_server:2.2.3",
          "part": "a",
          "vendor": "apache",
          "product": "http_server",
          "version": "2\\.2\\.3",
          "language": "ANY",
          "edition": "ANY",
          "update": "ANY"
        }
      ],
      "modules": {
        "http": {
          "body": "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>503 Service Temporarily Unavailable</title>\n</head><body>\n<h1>Service Temporarily Unavailable</h1>\n<p>The server is temporarily unable to service your\nrequest due to maintenance downtime or capacity\nproblems. Please try again later.</p>\n<hr>\n<address>Apache/2.2.3 (CentOS) Server at 182.48.57.47 Port 80</address>\n</body></html>\n",
          "body_murmur": -1519400894,
          "body_sha256": "b683ccf263fa8e275174a00e1c3e6022f87c7e74b92dc82072fb453890270150",
          "content_length": 400,
          "headers": {
            "content_length": [
              "400"
            ],
            "content_type": [
              "text/html; charset=iso-8859-1"
            ],
            "date": [
              "Sat, 07 Feb 2026 17:34:28 GMT"
            ]
          },
          "protocol": "HTTP/1.1",
          "request": {
            "headers": {
              "accept": [
                "*/*"
              ],
              "user_agent": [
                "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
              ]
            },
            "method": "GET",
            "url": {
              "host": "182.48.57.47",
              "path": "",
              "scheme": "http"
            }
          },
          "status_code": 503,
          "title": "503 Service Temporarily Unavailable"
        }
      },
      "cve": [
        {
          "id": "CVE-2006-20001",
          "score": 7.5,
          "severity": "high"
        },
        {
          "id": "CVE-2006-5752",
          "score": 4.3,
          "severity": "medium"
        },
        {
          "id": "CVE-2007-1741",
          "score": 6.2,
          "severity": "medium"
        }
      ],
      "url": "http://182.48.57.47/",
      "_meta": {
        "name": "",
        "desc": "",
        "category": ""
      },
      "last_updated_at": "2026-02-07T17:34:29.436Z"
    },
    {
      "port": 143,
      "protocol": "tcp",
      "name": "imap",
      "version": "",
      "product": "Dovecot imapd",
      "extra_info": "",
      "tunnel": "",
      "softwares": [
        {
          "uri": "cpe:/a:dovecot:dovecot",
          "part": "a",
          "vendor": "dovecot",
          "product": "dovecot",
          "version": "ANY",
          "language": "ANY",
          "edition": "ANY",
          "update": "ANY"
        }
      ],
      "modules": {
        "imap": {
          "banner": "* OK Dovecot ready.\r\n"
        },
        "tls": {
          "certificate": {
            "extensions": {
              "ns_cert_type": {
                "ssl_server": true
              }
            },
            "fingerprint_md5": "F0B07E0017DE0FDCF82D54C5561E27AB",
            "fingerprint_sha1": "E18A5D8DAA55E292970726CFBD01B40A1626FB44",
            "fingerprint_sha256": "5A8F9B13263EE64DFE60FC45D12EAC1B12706378B72EF61DF2C39CA832ACB965",
            "issuer": {
              "common_name": [
                "imap.example.com"
              ],
              "email_address": [
                "[email protected]"
              ],
              "organizational_unit": [
                "IMAP server"
              ]
            },
            "issuer_dn": "/OU=IMAP server/CN=imap.example.com/[email protected]",
            "jarm": "00000000000000000000000000000000000000000000000000000000000000",
            "redacted": false,
            "revocation": {
              "ocsp": {
                "reason": "UNKNOWN",
                "revoked": false
              }
            },
            "serial_number": "13956044739935303735",
            "signature": {
              "algorithm": {
                "name": "SHA1-RSA",
                "oid": "1.2.840.113549.1.1.5"
              },
              "self_signed": true,
              "value": "MjVmOTQxZDk0NjRmYzNiNzJkNWRhYmUyYWE1ZGI3ZmNmZjRkZGU2MmQ3ZWE5YmExYzQ4YzlmNTQyNjFmNGRmODQ3NTIxMzcwNTUyODY1NGNhOWI2MDExZDRhMGU2NWExMGNhNTY1ZjEzZGI4ZDQyMmQxYzYyYjY4ZDEyMmUyNzI1NTY2Yzc3NWIyMmI5YWVmYzczOTQ4YTAyOWFhNDZlNWFmMDI2NTQzM2JiZWNiY2M3MTZlMTk3ZmM3ZTJiMmY4OGU0ZjAzNWEwZDA5OWFhN2UwYjIzZmYwMDIyYTAzZTc0MmYyYTlkNDM3NTY1ZjM3YzRkYzFlYzIyNTM3YmE1OA=="
            },
            "subject": {
              "common_name": [
                "imap.example.com"
              ],
              "email_address": [
                "[email protected]"
              ],
              "organizational_unit": [
                "IMAP server"
              ]
            },
            "subject_alt_name": {
              "dns_names": [
                "imap.example.com"
              ],
              "extended_dns_names": [
                {
                  "domain": "example",
                  "fld": "example.com",
                  "subdomain": "imap",
                  "tld": "com"
                }
              ]
            },
            "subject_dn": "/OU=IMAP server/CN=imap.example.com/[email protected]",
            "subject_key_info": {
              "_key": "rsa",
              "dh": [],
              "dsa": [],
              "ecdsa": [],
              "fingerprint_sha256": "8d93ba5c4e3d2258a6cf349e9b5e6c49546750637fb1a5ba3c912e5e66469a8e",
              "key_algorithm": "RSA",
              "rsa": {
                "exponent": 65537,
                "length": 1024,
                "modulus": "MHhlNzIwNDc0Yzc2OWVlNzNjMGE0MGI2YWE1YTZiZThjYTAzMGJlNGE5YTliMjBjNGU1ODUyNzg2MWExYjk1MmM4MTc5NDQ0MWQ0YjA5MDlmMjZmZDdjMDc0NGFmNDE3YmZjZTQ0NzBjMjg1MDk1MjdkNzcxNzk5YWMxMDBhZjEyNTRlMmQwNGFlNTNhOTIwMzE3ZTM5MWRhYWFlNmIzOWIxY2QyYWY3NTNiNDMxOTBlYjhhMzQ0ZWMzNDA0MzNhMDI3ZmZkY2QzZjQwYWZhMDgzNDJmZjQxNTgwOTczZDQ1ZmUwMmI3ZTFkOGRlMGMyZWMyN2I0Y2ZkYjY3ZmQzZTEz"
              }
            },
            "tbs_fingerprint": "e36cb9db923d1cc23731f2bcdb1836d870915883150f4ebe295b216be357925d",
            "validation_level": "OV",
            "validity": {
              "length_seconds": 31536000,
              "not_after": "2013-04-20T19:22:48",
              "not_before": "2012-04-20T19:22:48"
            },
            "version": 2
          },
          "fingerprint_sha256": "5A8F9B13263EE64DFE60FC45D12EAC1B12706378B72EF61DF2C39CA832ACB965",
          "precert": false,
          "raw": "MIICQzCCAaygAwIBAgIJAMGt1L+pTXg3MA0GCSqGSIb3DQEBBQUAMFgxFDASBgNVBAsTC0lNQVAgc2VydmVyMRkwFwYDVQQDExBpbWFwLmV4YW1wbGUuY29tMSUwIwYJKoZIhvcNAQkBFhZwb3N0bWFzdGVyQGV4YW1wbGUuY29tMB4XDTEyMDQyMDE5MjI0OFoXDTEzMDQyMDE5MjI0OFowWDEUMBIGA1UECxMLSU1BUCBzZXJ2ZXIxGTAXBgNVBAMTEGltYXAuZXhhbXBsZS5jb20xJTAjBgkqhkiG9w0BCQEWFnBvc3RtYXN0ZXJAZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOcgR0x2nuc8CkC2qlpr6MoDC+SpqbIMTlhSeGGhuVLIF5REHUsJCfJv18B0SvQXv85EcMKFCVJ9dxeZrBAK8SVOLQSuU6kgMX45HaquazmxzSr3U7QxkOuKNE7DQEM6An/9zT9Ar6CDQv9BWAlz1F/gK34djeDC7Ce0z9tn/T4TAgMBAAGjFTATMBEGCWCGSAGG+EIBAQQEAwIGQDANBgkqhkiG9w0BAQUFAAOBgQAl+UHZRk/Dty1dq+KqXbf8/03eYtfqm6HEjJ9UJh9N+EdSE3BVKGVMqbYBHUoOZaEMpWXxPbjUItHGK2jRIuJyVWbHdbIrmu/HOUigKapG5a8CZUM7vsvMcW4Zf8fisviOTwNaDQmap+CyP/ACKgPnQvKp1DdWXzfE3B7CJTe6WA==",
          "tags": [
            "ov",
            "self_signed",
            "root"
          ]
        }
      },
      "_meta": {
        "name": "",
        "desc": "",
        "category": ""
      },
      "last_updated_at": "2026-02-11T17:46:18.844Z"
    },
    {
      "port": 993,
      "protocol": "tcp",
      "name": "unknown",
      "version": "",
      "product": "",
      "extra_info": "",
      "tunnel": "",
      "_meta": {
        "name": "",
        "desc": "",
        "category": ""
      },
      "last_updated_at": "2026-02-08T23:27:37.131Z"
    },
    {
      "port": 3306,
      "protocol": "tcp",
      "name": "mysql",
      "version": "5.0.95",
      "product": "MySQL",
      "extra_info": "",
      "tunnel": "",
      "softwares": [
        {
          "uri": "cpe:/a:mysql:mysql:5.0.95",
          "part": "a",
          "vendor": "mysql",
          "product": "mysql",
          "version": "5\\.0\\.95",
          "language": "ANY",
          "edition": "ANY",
          "update": "ANY"
        }
      ],
      "modules": {
        "mysql": {
          "capability_flags": {
            "CLIENT_COMPRESS": true,
            "CLIENT_CONNECT_WITH_DB": true,
            "CLIENT_LONG_FLAG": true,
            "CLIENT_PROTOCOL_41": true,
            "CLIENT_SECURE_CONNECTION": true,
            "CLIENT_TRANSACTIONS": true
          },
          "protocol_version": 10,
          "version": "5.0.95"
        }
      },
      "cve": [
        {
          "id": "CVE-2007-5925",
          "score": 4,
          "severity": "medium"
        },
        {
          "id": "CVE-2009-0819",
          "score": 4,
          "severity": "medium"
        },
        {
          "id": "CVE-2010-1621",
          "score": 5,
          "severity": "medium"
        }
      ],
      "_meta": {
        "name": "",
        "desc": "",
        "category": ""
      },
      "last_updated_at": "2026-02-12T22:56:29.859Z"
    }
  ],
  "services_hash": "088566688c32bf620b8ef5c825e793f93aec060d6f185449a2b2bb9f205466b9",
  "last_updated_at": "2026-02-12T22:56:29.859Z",
  "banner": [
    "mysql",
    "ssh",
    "smtp",
    "http",
    "imap",
    "tls"
  ],
  "is_vuln": true,
  "cveDetails": {
    "CVE-2006-20001": {
      "id": "CVE-2006-20001",
      "references": [
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.gentoo.org/glsa/202309-01",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.gentoo.org/glsa/202309-01",
        "https://security.netapp.com/advisory/ntap-20230316-0005/"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.\n\nThis issue affects Apache HTTP Server 2.4.54 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-787"
    },
    "CVE-2006-4924": {
      "id": "CVE-2006-4924",
      "references": [
        "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc",
        "ftp://ftp.sco.com/pub/unixware7/714/security/p534336/p534336.txt",
        "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc",
        "http://blogs.sun.com/security/entry/sun_alert_102962_security_vulnerability",
        "http://bugs.gentoo.org/show_bug.cgi?id=148228",
        "http://docs.info.apple.com/article.html?artnum=305214",
        "http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112",
        "http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112",
        "http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html",
        "http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2",
        "http://secunia.com/advisories/21923",
        "http://secunia.com/advisories/22091",
        "http://secunia.com/advisories/22116",
        "http://secunia.com/advisories/22158",
        "http://secunia.com/advisories/22164",
        "http://secunia.com/advisories/22183",
        "http://secunia.com/advisories/22196",
        "http://secunia.com/advisories/22208",
        "http://secunia.com/advisories/22236",
        "http://secunia.com/advisories/22245",
        "http://secunia.com/advisories/22270",
        "http://secunia.com/advisories/22298",
        "http://secunia.com/advisories/22352",
        "http://secunia.com/advisories/22362",
        "http://secunia.com/advisories/22487",
        "http://secunia.com/advisories/22495",
        "http://secunia.com/advisories/22823",
        "http://secunia.com/advisories/22926",
        "http://secunia.com/advisories/23038",
        "http://secunia.com/advisories/23241",
        "http://secunia.com/advisories/23340",
        "http://secunia.com/advisories/23680",
        "http://secunia.com/advisories/24479",
        "http://secunia.com/advisories/24799",
        "http://secunia.com/advisories/24805",
        "http://secunia.com/advisories/25608",
        "http://secunia.com/advisories/29371",
        "http://secunia.com/advisories/34274",
        "http://security.freebsd.org/advisories/FreeBSD-SA-06%3A22.openssh.asc",
        "http://security.gentoo.org/glsa/glsa-200609-17.xml",
        "http://security.gentoo.org/glsa/glsa-200611-06.xml",
        "http://securitytracker.com/id?1016931",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566",
        "http://sourceforge.net/forum/forum.php?forum_id=681763",
        "http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102962-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm",
        "http://www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.html",
        "http://www.debian.org/security/2006/dsa-1189",
        "http://www.debian.org/security/2006/dsa-1212",
        "http://www.kb.cert.org/vuls/id/787448",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:179",
        "http://www.novell.com/linux/security/advisories/2006_24_sr.html",
        "http://www.novell.com/linux/security/advisories/2006_62_openssh.html",
        "http://www.openbsd.org/errata.html#ssh",
        "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.022-openssh.html",
        "http://www.osvdb.org/29152",
        "http://www.redhat.com/support/errata/RHSA-2006-0697.html",
        "http://www.redhat.com/support/errata/RHSA-2006-0698.html",
        "http://www.securityfocus.com/archive/1/447153/100/0/threaded",
        "http://www.securityfocus.com/bid/20216",
        "http://www.trustix.org/errata/2006/0054",
        "http://www.ubuntu.com/usn/usn-355-1",
        "http://www.us-cert.gov/cas/techalerts/TA07-072A.html",
        "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
        "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
        "http://www.vupen.com/english/advisories/2006/3777",
        "http://www.vupen.com/english/advisories/2006/4401",
        "http://www.vupen.com/english/advisories/2006/4869",
        "http://www.vupen.com/english/advisories/2007/0930",
        "http://www.vupen.com/english/advisories/2007/1332",
        "http://www.vupen.com/english/advisories/2007/2119",
        "http://www.vupen.com/english/advisories/2009/0740",
        "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207955",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/29158",
        "https://hypersonic.bluecoat.com/support/securityadvisories/ssh_server_on_sg",
        "https://issues.rpath.com/browse/RPL-661",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10462",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1193",
        "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc",
        "ftp://ftp.sco.com/pub/unixware7/714/security/p534336/p534336.txt",
        "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc",
        "http://blogs.sun.com/security/entry/sun_alert_102962_security_vulnerability",
        "http://bugs.gentoo.org/show_bug.cgi?id=148228",
        "http://docs.info.apple.com/article.html?artnum=305214",
        "http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112",
        "http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112",
        "http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html",
        "http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2",
        "http://secunia.com/advisories/21923",
        "http://secunia.com/advisories/22091",
        "http://secunia.com/advisories/22116",
        "http://secunia.com/advisories/22158",
        "http://secunia.com/advisories/22164",
        "http://secunia.com/advisories/22183",
        "http://secunia.com/advisories/22196",
        "http://secunia.com/advisories/22208",
        "http://secunia.com/advisories/22236",
        "http://secunia.com/advisories/22245",
        "http://secunia.com/advisories/22270",
        "http://secunia.com/advisories/22298",
        "http://secunia.com/advisories/22352",
        "http://secunia.com/advisories/22362",
        "http://secunia.com/advisories/22487",
        "http://secunia.com/advisories/22495",
        "http://secunia.com/advisories/22823",
        "http://secunia.com/advisories/22926",
        "http://secunia.com/advisories/23038",
        "http://secunia.com/advisories/23241",
        "http://secunia.com/advisories/23340",
        "http://secunia.com/advisories/23680",
        "http://secunia.com/advisories/24479",
        "http://secunia.com/advisories/24799",
        "http://secunia.com/advisories/24805",
        "http://secunia.com/advisories/25608",
        "http://secunia.com/advisories/29371",
        "http://secunia.com/advisories/34274",
        "http://security.freebsd.org/advisories/FreeBSD-SA-06%3A22.openssh.asc",
        "http://security.gentoo.org/glsa/glsa-200609-17.xml",
        "http://security.gentoo.org/glsa/glsa-200611-06.xml",
        "http://securitytracker.com/id?1016931",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566",
        "http://sourceforge.net/forum/forum.php?forum_id=681763",
        "http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102962-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm",
        "http://www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.html",
        "http://www.debian.org/security/2006/dsa-1189",
        "http://www.debian.org/security/2006/dsa-1212",
        "http://www.kb.cert.org/vuls/id/787448",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:179",
        "http://www.novell.com/linux/security/advisories/2006_24_sr.html",
        "http://www.novell.com/linux/security/advisories/2006_62_openssh.html",
        "http://www.openbsd.org/errata.html#ssh",
        "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.022-openssh.html",
        "http://www.osvdb.org/29152",
        "http://www.redhat.com/support/errata/RHSA-2006-0697.html",
        "http://www.redhat.com/support/errata/RHSA-2006-0698.html",
        "http://www.securityfocus.com/archive/1/447153/100/0/threaded",
        "http://www.securityfocus.com/bid/20216",
        "http://www.trustix.org/errata/2006/0054",
        "http://www.ubuntu.com/usn/usn-355-1",
        "http://www.us-cert.gov/cas/techalerts/TA07-072A.html",
        "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
        "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
        "http://www.vupen.com/english/advisories/2006/3777",
        "http://www.vupen.com/english/advisories/2006/4401",
        "http://www.vupen.com/english/advisories/2006/4869",
        "http://www.vupen.com/english/advisories/2007/0930",
        "http://www.vupen.com/english/advisories/2007/1332",
        "http://www.vupen.com/english/advisories/2007/2119",
        "http://www.vupen.com/english/advisories/2009/0740",
        "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207955",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/29158",
        "https://hypersonic.bluecoat.com/support/securityadvisories/ssh_server_on_sg",
        "https://issues.rpath.com/browse/RPL-661",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10462",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1193"
      ],
      "score": 7.8,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
      "weakness": "CWE-399"
    },
    "CVE-2006-5051": {
      "id": "CVE-2006-5051",
      "references": [
        "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc",
        "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc",
        "http://docs.info.apple.com/article.html?artnum=305214",
        "http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html",
        "http://lists.freebsd.org/pipermail/freebsd-security/2006-October/004051.html",
        "http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2",
        "http://openssh.org/txt/release-4.4",
        "http://secunia.com/advisories/22158",
        "http://secunia.com/advisories/22173",
        "http://secunia.com/advisories/22183",
        "http://secunia.com/advisories/22196",
        "http://secunia.com/advisories/22208",
        "http://secunia.com/advisories/22236",
        "http://secunia.com/advisories/22245",
        "http://secunia.com/advisories/22270",
        "http://secunia.com/advisories/22352",
        "http://secunia.com/advisories/22362",
        "http://secunia.com/advisories/22487",
        "http://secunia.com/advisories/22495",
        "http://secunia.com/advisories/22823",
        "http://secunia.com/advisories/22926",
        "http://secunia.com/advisories/23680",
        "http://secunia.com/advisories/24479",
        "http://secunia.com/advisories/24799",
        "http://secunia.com/advisories/24805",
        "http://security.freebsd.org/advisories/FreeBSD-SA-06%3A22.openssh.asc",
        "http://security.gentoo.org/glsa/glsa-200611-06.xml",
        "http://securitytracker.com/id?1016940",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566",
        "http://sourceforge.net/forum/forum.php?forum_id=681763",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm",
        "http://www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.html",
        "http://www.arkoon.fr/upload/alertes/36AK-2006-07-FR-1.0_FAST360_OPENSSH.pdf",
        "http://www.arkoon.fr/upload/alertes/43AK-2006-09-FR-1.0_SSL360_OPENSSH.pdf",
        "http://www.debian.org/security/2006/dsa-1189",
        "http://www.debian.org/security/2006/dsa-1212",
        "http://www.kb.cert.org/vuls/id/851340",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:179",
        "http://www.novell.com/linux/security/advisories/2006_62_openssh.html",
        "http://www.openbsd.org/errata.html#ssh",
        "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.022-openssh.html",
        "http://www.openwall.com/lists/oss-security/2024/07/01/3",
        "http://www.openwall.com/lists/oss-security/2024/07/28/3",
        "http://www.osvdb.org/29264",
        "http://www.redhat.com/support/errata/RHSA-2006-0697.html",
        "http://www.redhat.com/support/errata/RHSA-2006-0698.html",
        "http://www.securityfocus.com/bid/20241",
        "http://www.ubuntu.com/usn/usn-355-1",
        "http://www.us-cert.gov/cas/techalerts/TA07-072A.html",
        "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
        "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
        "http://www.vupen.com/english/advisories/2006/4018",
        "http://www.vupen.com/english/advisories/2006/4329",
        "http://www.vupen.com/english/advisories/2007/0930",
        "http://www.vupen.com/english/advisories/2007/1332",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/29254",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11387",
        "https://www.openwall.com/lists/oss-security/2024/07/28/3",
        "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc",
        "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc",
        "http://docs.info.apple.com/article.html?artnum=305214",
        "http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html",
        "http://lists.freebsd.org/pipermail/freebsd-security/2006-October/004051.html",
        "http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2",
        "http://openssh.org/txt/release-4.4",
        "http://secunia.com/advisories/22158",
        "http://secunia.com/advisories/22173",
        "http://secunia.com/advisories/22183",
        "http://secunia.com/advisories/22196",
        "http://secunia.com/advisories/22208",
        "http://secunia.com/advisories/22236",
        "http://secunia.com/advisories/22245",
        "http://secunia.com/advisories/22270",
        "http://secunia.com/advisories/22352",
        "http://secunia.com/advisories/22362",
        "http://secunia.com/advisories/22487",
        "http://secunia.com/advisories/22495",
        "http://secunia.com/advisories/22823",
        "http://secunia.com/advisories/22926",
        "http://secunia.com/advisories/23680",
        "http://secunia.com/advisories/24479",
        "http://secunia.com/advisories/24799",
        "http://secunia.com/advisories/24805",
        "http://security.freebsd.org/advisories/FreeBSD-SA-06%3A22.openssh.asc",
        "http://security.gentoo.org/glsa/glsa-200611-06.xml",
        "http://securitytracker.com/id?1016940",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566",
        "http://sourceforge.net/forum/forum.php?forum_id=681763",
        "http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm",
        "http://www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.html",
        "http://www.arkoon.fr/upload/alertes/36AK-2006-07-FR-1.0_FAST360_OPENSSH.pdf",
        "http://www.arkoon.fr/upload/alertes/43AK-2006-09-FR-1.0_SSL360_OPENSSH.pdf",
        "http://www.debian.org/security/2006/dsa-1189",
        "http://www.debian.org/security/2006/dsa-1212",
        "http://www.kb.cert.org/vuls/id/851340",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:179",
        "http://www.novell.com/linux/security/advisories/2006_62_openssh.html",
        "http://www.openbsd.org/errata.html#ssh",
        "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.022-openssh.html",
        "http://www.openwall.com/lists/oss-security/2024/07/01/3",
        "http://www.openwall.com/lists/oss-security/2024/07/28/3",
        "http://www.osvdb.org/29264",
        "http://www.redhat.com/support/errata/RHSA-2006-0697.html",
        "http://www.redhat.com/support/errata/RHSA-2006-0698.html",
        "http://www.securityfocus.com/bid/20241",
        "http://www.ubuntu.com/usn/usn-355-1",
        "http://www.us-cert.gov/cas/techalerts/TA07-072A.html",
        "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
        "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
        "http://www.vupen.com/english/advisories/2006/4018",
        "http://www.vupen.com/english/advisories/2006/4329",
        "http://www.vupen.com/english/advisories/2007/0930",
        "http://www.vupen.com/english/advisories/2007/1332",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/29254",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11387",
        "https://www.openwall.com/lists/oss-security/2024/07/28/3"
      ],
      "score": 8.1,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-415"
    },
    "CVE-2006-5052": {
      "id": "CVE-2006-5052",
      "references": [
        "http://docs.info.apple.com/article.html?artnum=305214",
        "http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html",
        "http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2",
        "http://openssh.org/txt/release-4.4",
        "http://rhn.redhat.com/errata/RHSA-2006-0697.html",
        "http://secunia.com/advisories/22158",
        "http://secunia.com/advisories/22173",
        "http://secunia.com/advisories/22495",
        "http://secunia.com/advisories/22823",
        "http://secunia.com/advisories/24479",
        "http://secunia.com/advisories/27588",
        "http://secunia.com/advisories/28320",
        "http://security.gentoo.org/glsa/glsa-200611-06.xml",
        "http://securitytracker.com/id?1016939",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-527.htm",
        "http://www.novell.com/linux/security/advisories/2006_62_openssh.html",
        "http://www.osvdb.org/29266",
        "http://www.redhat.com/support/errata/RHSA-2007-0540.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0703.html",
        "http://www.securityfocus.com/archive/1/447861/100/200/threaded",
        "http://www.securityfocus.com/bid/20245",
        "http://www.us-cert.gov/cas/techalerts/TA07-072A.html",
        "http://www.vupen.com/english/advisories/2007/0930",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/29255",
        "https://issues.rpath.com/browse/RPL-681",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10178",
        "http://docs.info.apple.com/article.html?artnum=305214",
        "http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html",
        "http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2",
        "http://openssh.org/txt/release-4.4",
        "http://rhn.redhat.com/errata/RHSA-2006-0697.html",
        "http://secunia.com/advisories/22158",
        "http://secunia.com/advisories/22173",
        "http://secunia.com/advisories/22495",
        "http://secunia.com/advisories/22823",
        "http://secunia.com/advisories/24479",
        "http://secunia.com/advisories/27588",
        "http://secunia.com/advisories/28320",
        "http://security.gentoo.org/glsa/glsa-200611-06.xml",
        "http://securitytracker.com/id?1016939",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-527.htm",
        "http://www.novell.com/linux/security/advisories/2006_62_openssh.html",
        "http://www.osvdb.org/29266",
        "http://www.redhat.com/support/errata/RHSA-2007-0540.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0703.html",
        "http://www.securityfocus.com/archive/1/447861/100/200/threaded",
        "http://www.securityfocus.com/bid/20245",
        "http://www.us-cert.gov/cas/techalerts/TA07-072A.html",
        "http://www.vupen.com/english/advisories/2007/0930",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/29255",
        "https://issues.rpath.com/browse/RPL-681",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10178"
      ],
      "score": 5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI \"authentication abort.\"",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2006-5752": {
      "id": "CVE-2006-5752",
      "references": [
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://osvdb.org/37052",
        "http://rhn.redhat.com/errata/RHSA-2007-0534.html",
        "http://rhn.redhat.com/errata/RHSA-2007-0556.html",
        "http://secunia.com/advisories/25827",
        "http://secunia.com/advisories/25830",
        "http://secunia.com/advisories/25873",
        "http://secunia.com/advisories/25920",
        "http://secunia.com/advisories/26273",
        "http://secunia.com/advisories/26443",
        "http://secunia.com/advisories/26458",
        "http://secunia.com/advisories/26508",
        "http://secunia.com/advisories/26822",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27037",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28212",
        "http://secunia.com/advisories/28224",
        "http://secunia.com/advisories/28606",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
        "http://svn.apache.org/viewvc?view=rev&revision=549159",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:141",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0532.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0557.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/24645",
        "http://www.securitytracker.com/id?1018302",
        "http://www.trustix.org/errata/2007/0026/",
        "http://www.ubuntu.com/usn/usn-499-1",
        "http://www.vupen.com/english/advisories/2007/2727",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3386",
        "http://www.vupen.com/english/advisories/2007/4305",
        "http://www.vupen.com/english/advisories/2008/0233",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/35097",
        "https://issues.rpath.com/browse/RPL-1500",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154",
        "https://rhn.redhat.com/errata/RHSA-2007-0533.html",
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://osvdb.org/37052",
        "http://rhn.redhat.com/errata/RHSA-2007-0534.html",
        "http://rhn.redhat.com/errata/RHSA-2007-0556.html",
        "http://secunia.com/advisories/25827",
        "http://secunia.com/advisories/25830",
        "http://secunia.com/advisories/25873",
        "http://secunia.com/advisories/25920",
        "http://secunia.com/advisories/26273",
        "http://secunia.com/advisories/26443",
        "http://secunia.com/advisories/26458",
        "http://secunia.com/advisories/26508",
        "http://secunia.com/advisories/26822",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27037",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28212",
        "http://secunia.com/advisories/28224",
        "http://secunia.com/advisories/28606",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
        "http://svn.apache.org/viewvc?view=rev&revision=549159",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:141",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0532.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0557.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/24645",
        "http://www.securitytracker.com/id?1018302",
        "http://www.trustix.org/errata/2007/0026/",
        "http://www.ubuntu.com/usn/usn-499-1",
        "http://www.vupen.com/english/advisories/2007/2727",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3386",
        "http://www.vupen.com/english/advisories/2007/4305",
        "http://www.vupen.com/english/advisories/2008/0233",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/35097",
        "https://issues.rpath.com/browse/RPL-1500",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154",
        "https://rhn.redhat.com/errata/RHSA-2007-0533.html"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2006-5794": {
      "id": "CVE-2006-5794",
      "references": [
        "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc",
        "http://rhn.redhat.com/errata/RHSA-2006-0738.html",
        "http://secunia.com/advisories/22771",
        "http://secunia.com/advisories/22772",
        "http://secunia.com/advisories/22773",
        "http://secunia.com/advisories/22778",
        "http://secunia.com/advisories/22814",
        "http://secunia.com/advisories/22872",
        "http://secunia.com/advisories/22932",
        "http://secunia.com/advisories/23513",
        "http://secunia.com/advisories/23680",
        "http://secunia.com/advisories/24055",
        "http://securitytracker.com/id?1017183",
        "http://sourceforge.net/project/shownotes.php?release_id=461854&group_id=69227",
        "http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-048.htm",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:204",
        "http://www.novell.com/linux/security/advisories/2006_26_sr.html",
        "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.032-openssh.html",
        "http://www.openssh.org/txt/release-4.5",
        "http://www.securityfocus.com/archive/1/451100/100/0/threaded",
        "http://www.securityfocus.com/bid/20956",
        "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
        "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
        "http://www.vupen.com/english/advisories/2006/4399",
        "http://www.vupen.com/english/advisories/2006/4400",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/30120",
        "https://issues.rpath.com/browse/RPL-766",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11840",
        "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc",
        "http://rhn.redhat.com/errata/RHSA-2006-0738.html",
        "http://secunia.com/advisories/22771",
        "http://secunia.com/advisories/22772",
        "http://secunia.com/advisories/22773",
        "http://secunia.com/advisories/22778",
        "http://secunia.com/advisories/22814",
        "http://secunia.com/advisories/22872",
        "http://secunia.com/advisories/22932",
        "http://secunia.com/advisories/23513",
        "http://secunia.com/advisories/23680",
        "http://secunia.com/advisories/24055",
        "http://securitytracker.com/id?1017183",
        "http://sourceforge.net/project/shownotes.php?release_id=461854&group_id=69227",
        "http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-048.htm",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2006:204",
        "http://www.novell.com/linux/security/advisories/2006_26_sr.html",
        "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.032-openssh.html",
        "http://www.openssh.org/txt/release-4.5",
        "http://www.securityfocus.com/archive/1/451100/100/0/threaded",
        "http://www.securityfocus.com/bid/20956",
        "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
        "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
        "http://www.vupen.com/english/advisories/2006/4399",
        "http://www.vupen.com/english/advisories/2006/4400",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/30120",
        "https://issues.rpath.com/browse/RPL-766",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11840"
      ],
      "score": 7.5,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2007-1741": {
      "id": "CVE-2007-1741",
      "references": [
        "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511",
        "http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2",
        "http://osvdb.org/38639",
        "http://www.securityfocus.com/bid/23438",
        "http://www.securitytracker.com/id?1017904",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/33584"
      ],
      "score": 6.2,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"",
      "vector_string": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
      "weakness": "CWE-362"
    },
    "CVE-2007-1742": {
      "id": "CVE-2007-1742",
      "references": [
        "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511",
        "http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2",
        "http://osvdb.org/38640",
        "http://www.securitytracker.com/id?1017904"
      ],
      "score": 3.7,
      "services": [
        "80/http"
      ],
      "severity": "low",
      "summary": "suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using \"html_backup\" and \"htmleditor\" under an \"html\" directory.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"",
      "vector_string": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2007-1743": {
      "id": "CVE-2007-1743",
      "references": [
        "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511",
        "http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2",
        "http://www.securitytracker.com/id?1017904"
      ],
      "score": 4.4,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"  In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.",
      "vector_string": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2007-1863": {
      "id": "CVE-2007-1863",
      "references": [
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244658",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://osvdb.org/37079",
        "http://rhn.redhat.com/errata/RHSA-2007-0534.html",
        "http://rhn.redhat.com/errata/RHSA-2007-0556.html",
        "http://secunia.com/advisories/25830",
        "http://secunia.com/advisories/25873",
        "http://secunia.com/advisories/25920",
        "http://secunia.com/advisories/26273",
        "http://secunia.com/advisories/26443",
        "http://secunia.com/advisories/26508",
        "http://secunia.com/advisories/26822",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27037",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28606",
        "http://secunia.com/advisories/30430",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
        "http://svn.apache.org/viewvc?view=rev&revision=535617",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK49355",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:141",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0557.html",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/24649",
        "http://www.securitytracker.com/id?1018303",
        "http://www.trustix.org/errata/2007/0026/",
        "http://www.ubuntu.com/usn/usn-499-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2007/2727",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3386",
        "http://www.vupen.com/english/advisories/2008/0233",
        "http://www.vupen.com/english/advisories/2008/1697",
        "https://issues.rpath.com/browse/RPL-1500",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9824",
        "https://rhn.redhat.com/errata/RHSA-2007-0533.html"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2007-2243": {
      "id": "CVE-2007-2243",
      "references": [
        "http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053906.html",
        "http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053951.html",
        "http://securityreason.com/securityalert/2631",
        "http://www.osvdb.org/34600",
        "http://www.securityfocus.com/bid/23601",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/33794",
        "https://security.netapp.com/advisory/ntap-20191107-0003/",
        "http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053906.html",
        "http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053951.html",
        "http://securityreason.com/securityalert/2631",
        "http://www.osvdb.org/34600",
        "http://www.securityfocus.com/bid/23601",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/33794",
        "https://security.netapp.com/advisory/ntap-20191107-0003/"
      ],
      "score": 5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "weakness": "CWE-287"
    },
    "CVE-2007-2768": {
      "id": "CVE-2007-2768",
      "references": [
        "http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0635.html",
        "http://www.osvdb.org/34601",
        "https://security.netapp.com/advisory/ntap-20191107-0002/",
        "http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0635.html",
        "http://www.osvdb.org/34601",
        "https://security.netapp.com/advisory/ntap-20191107-0002/"
      ],
      "score": 4.3,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.",
      "vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
      "weakness": "CWE-200"
    },
    "CVE-2007-3304": {
      "id": "CVE-2007-3304",
      "references": [
        "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc",
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e",
        "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2",
        "http://osvdb.org/38939",
        "http://rhn.redhat.com/errata/RHSA-2007-0556.html",
        "http://secunia.com/advisories/25827",
        "http://secunia.com/advisories/25830",
        "http://secunia.com/advisories/25920",
        "http://secunia.com/advisories/26211",
        "http://secunia.com/advisories/26273",
        "http://secunia.com/advisories/26443",
        "http://secunia.com/advisories/26508",
        "http://secunia.com/advisories/26611",
        "http://secunia.com/advisories/26759",
        "http://secunia.com/advisories/26790",
        "http://secunia.com/advisories/26822",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27121",
        "http://secunia.com/advisories/27209",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28212",
        "http://secunia.com/advisories/28224",
        "http://secunia.com/advisories/28606",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://security.psnc.pl/files/apache_report.pdf",
        "http://securityreason.com/securityalert/2814",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm",
        "http://svn.apache.org/viewvc?view=rev&revision=547987",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/errata/RHSA-2007-0532.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0557.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0662.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/469899/100/0/threaded",
        "http://www.securityfocus.com/archive/1/471832/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/24215",
        "http://www.securitytracker.com/id?1018304",
        "http://www.trustix.org/errata/2007/0026/",
        "http://www.ubuntu.com/usn/usn-499-1",
        "http://www.vupen.com/english/advisories/2007/2727",
        "http://www.vupen.com/english/advisories/2007/3100",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3420",
        "http://www.vupen.com/english/advisories/2007/3494",
        "http://www.vupen.com/english/advisories/2007/4305",
        "http://www.vupen.com/english/advisories/2008/0233",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095",
        "https://issues.rpath.com/browse/RPL-1710",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589",
        "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc",
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e",
        "http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2",
        "http://osvdb.org/38939",
        "http://rhn.redhat.com/errata/RHSA-2007-0556.html",
        "http://secunia.com/advisories/25827",
        "http://secunia.com/advisories/25830",
        "http://secunia.com/advisories/25920",
        "http://secunia.com/advisories/26211",
        "http://secunia.com/advisories/26273",
        "http://secunia.com/advisories/26443",
        "http://secunia.com/advisories/26508",
        "http://secunia.com/advisories/26611",
        "http://secunia.com/advisories/26759",
        "http://secunia.com/advisories/26790",
        "http://secunia.com/advisories/26822",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27121",
        "http://secunia.com/advisories/27209",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28212",
        "http://secunia.com/advisories/28224",
        "http://secunia.com/advisories/28606",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://security.psnc.pl/files/apache_report.pdf",
        "http://securityreason.com/securityalert/2814",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm",
        "http://svn.apache.org/viewvc?view=rev&revision=547987",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/errata/RHSA-2007-0532.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0557.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0662.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/469899/100/0/threaded",
        "http://www.securityfocus.com/archive/1/471832/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/24215",
        "http://www.securitytracker.com/id?1018304",
        "http://www.trustix.org/errata/2007/0026/",
        "http://www.ubuntu.com/usn/usn-499-1",
        "http://www.vupen.com/english/advisories/2007/2727",
        "http://www.vupen.com/english/advisories/2007/3100",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3420",
        "http://www.vupen.com/english/advisories/2007/3494",
        "http://www.vupen.com/english/advisories/2007/4305",
        "http://www.vupen.com/english/advisories/2008/0233",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/35095",
        "https://issues.rpath.com/browse/RPL-1710",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589"
      ],
      "score": 4.7,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"",
      "vector_string": "AV:L/AC:M/Au:N/C:N/I:N/A:C",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2007-3847": {
      "id": "CVE-2007-3847",
      "references": [
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=apache-cvs&m=118592992309395&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=118595556504202&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=118595953217856&w=2",
        "http://secunia.com/advisories/26636",
        "http://secunia.com/advisories/26722",
        "http://secunia.com/advisories/26790",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26952",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27209",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27593",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/27882",
        "http://secunia.com/advisories/27971",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28606",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28922",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/30430",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-500.htm",
        "http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK50469",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:235",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0746.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0747.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0911.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/25489",
        "http://www.securitytracker.com/id?1018633",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2007/3020",
        "http://www.vupen.com/english/advisories/2007/3095",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3494",
        "http://www.vupen.com/english/advisories/2007/3955",
        "http://www.vupen.com/english/advisories/2008/0233",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1697",
        "https://issues.rpath.com/browse/RPL-1710",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10525",
        "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html",
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=apache-cvs&m=118592992309395&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=118595556504202&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=118595953217856&w=2",
        "http://secunia.com/advisories/26636",
        "http://secunia.com/advisories/26722",
        "http://secunia.com/advisories/26790",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26952",
        "http://secunia.com/advisories/26993",
        "http://secunia.com/advisories/27209",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27593",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/27882",
        "http://secunia.com/advisories/27971",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28606",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28922",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/30430",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
        "http://support.avaya.com/elmodocs2/security/ASA-2007-500.htm",
        "http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK50469",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:235",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0746.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0747.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0911.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/25489",
        "http://www.securitytracker.com/id?1018633",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2007/3020",
        "http://www.vupen.com/english/advisories/2007/3095",
        "http://www.vupen.com/english/advisories/2007/3283",
        "http://www.vupen.com/english/advisories/2007/3494",
        "http://www.vupen.com/english/advisories/2007/3955",
        "http://www.vupen.com/english/advisories/2008/0233",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1697",
        "https://issues.rpath.com/browse/RPL-1710",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10525",
        "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-125"
    },
    "CVE-2007-4465": {
      "id": "CVE-2007-4465",
      "references": [
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26952",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/30430",
        "http://secunia.com/advisories/31651",
        "http://secunia.com/advisories/33105",
        "http://secunia.com/advisories/35650",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://securityreason.com/achievement_securityalert/46",
        "http://securityreason.com/securityalert/3113",
        "http://securitytracker.com/id?1019194",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://www.apache.org/dist/httpd/CHANGES_2.2.6",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0911.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/479237/100/0/threaded",
        "http://www.securityfocus.com/bid/25653",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2008/1697",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/36586",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089",
        "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html",
        "http://bugs.gentoo.org/show_bug.cgi?id=186219",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://secunia.com/advisories/26842",
        "http://secunia.com/advisories/26952",
        "http://secunia.com/advisories/27563",
        "http://secunia.com/advisories/27732",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/30430",
        "http://secunia.com/advisories/31651",
        "http://secunia.com/advisories/33105",
        "http://secunia.com/advisories/35650",
        "http://security.gentoo.org/glsa/glsa-200711-06.xml",
        "http://securityreason.com/achievement_securityalert/46",
        "http://securityreason.com/securityalert/3113",
        "http://securitytracker.com/id?1019194",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://www.apache.org/dist/httpd/CHANGES_2.2.6",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
        "http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
        "http://www.redhat.com/support/errata/RHSA-2007-0911.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/479237/100/0/threaded",
        "http://www.securityfocus.com/bid/25653",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2008/1697",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/36586",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089",
        "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html"
      ],
      "score": 6.1,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset.  NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2007-4752": {
      "id": "CVE-2007-4752",
      "references": [
        "http://bugs.gentoo.org/show_bug.cgi?id=191321",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html",
        "http://secunia.com/advisories/27399",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/30249",
        "http://secunia.com/advisories/31575",
        "http://secunia.com/advisories/32241",
        "http://security.gentoo.org/glsa/glsa-200711-02.xml",
        "http://securityreason.com/securityalert/3126",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
        "http://www.debian.org/security/2008/dsa-1576",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236",
        "http://www.openssh.com/txt/release-4.7",
        "http://www.redhat.com/support/errata/RHSA-2008-0855.html",
        "http://www.securityfocus.com/archive/1/479760/100/0/threaded",
        "http://www.securityfocus.com/archive/1/483748/100/200/threaded",
        "http://www.securityfocus.com/bid/25628",
        "http://www.ubuntu.com/usn/usn-566-1",
        "http://www.vupen.com/english/advisories/2007/3156",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/2821",
        "https://bugzilla.redhat.com/show_bug.cgi?id=280471",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637",
        "https://issues.rpath.com/browse/RPL-1706",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599",
        "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html",
        "http://bugs.gentoo.org/show_bug.cgi?id=191321",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html",
        "http://secunia.com/advisories/27399",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/30249",
        "http://secunia.com/advisories/31575",
        "http://secunia.com/advisories/32241",
        "http://security.gentoo.org/glsa/glsa-200711-02.xml",
        "http://securityreason.com/securityalert/3126",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
        "http://www.debian.org/security/2008/dsa-1576",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236",
        "http://www.openssh.com/txt/release-4.7",
        "http://www.redhat.com/support/errata/RHSA-2008-0855.html",
        "http://www.securityfocus.com/archive/1/479760/100/0/threaded",
        "http://www.securityfocus.com/archive/1/483748/100/200/threaded",
        "http://www.securityfocus.com/bid/25628",
        "http://www.ubuntu.com/usn/usn-566-1",
        "http://www.vupen.com/english/advisories/2007/3156",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/2821",
        "https://bugzilla.redhat.com/show_bug.cgi?id=280471",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637",
        "https://issues.rpath.com/browse/RPL-1706",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599",
        "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
      ],
      "score": 7.5,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "weakness": "CWE-20"
    },
    "CVE-2007-5000": {
      "id": "CVE-2007-5000",
      "references": [
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://secunia.com/advisories/28046",
        "http://secunia.com/advisories/28073",
        "http://secunia.com/advisories/28081",
        "http://secunia.com/advisories/28196",
        "http://secunia.com/advisories/28375",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28525",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28750",
        "http://secunia.com/advisories/28922",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/29806",
        "http://secunia.com/advisories/29988",
        "http://secunia.com/advisories/30356",
        "http://secunia.com/advisories/30430",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/31142",
        "http://secunia.com/advisories/32800",
        "http://securitytracker.com/id?1019093",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK58024",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK58074",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
        "http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200801e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.osvdb.org/39134",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0007.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/494428/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/26838",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2007/4201",
        "http://www.vupen.com/english/advisories/2007/4202",
        "http://www.vupen.com/english/advisories/2007/4301",
        "http://www.vupen.com/english/advisories/2008/0084",
        "http://www.vupen.com/english/advisories/2008/0178",
        "http://www.vupen.com/english/advisories/2008/0398",
        "http://www.vupen.com/english/advisories/2008/0809/references",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1224/references",
        "http://www.vupen.com/english/advisories/2008/1623/references",
        "http://www.vupen.com/english/advisories/2008/1697",
        "http://www.vupen.com/english/advisories/2008/1875/references",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39001",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39002",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9539",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://secunia.com/advisories/28046",
        "http://secunia.com/advisories/28073",
        "http://secunia.com/advisories/28081",
        "http://secunia.com/advisories/28196",
        "http://secunia.com/advisories/28375",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28525",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28750",
        "http://secunia.com/advisories/28922",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/29806",
        "http://secunia.com/advisories/29988",
        "http://secunia.com/advisories/30356",
        "http://secunia.com/advisories/30430",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/31142",
        "http://secunia.com/advisories/32800",
        "http://securitytracker.com/id?1019093",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK58024",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK58074",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
        "http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200801e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.osvdb.org/39134",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0007.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/494428/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/26838",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2007/4201",
        "http://www.vupen.com/english/advisories/2007/4202",
        "http://www.vupen.com/english/advisories/2007/4301",
        "http://www.vupen.com/english/advisories/2008/0084",
        "http://www.vupen.com/english/advisories/2008/0178",
        "http://www.vupen.com/english/advisories/2008/0398",
        "http://www.vupen.com/english/advisories/2008/0809/references",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1224/references",
        "http://www.vupen.com/english/advisories/2008/1623/references",
        "http://www.vupen.com/english/advisories/2008/1697",
        "http://www.vupen.com/english/advisories/2008/1875/references",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39001",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39002",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9539",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2007-5925": {
      "id": "CVE-2007-5925",
      "references": [
        "http://bugs.gentoo.org/show_bug.cgi?id=198988",
        "http://bugs.mysql.com/bug.php?id=32125",
        "http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/067350.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html",
        "http://secunia.com/advisories/27568",
        "http://secunia.com/advisories/27649",
        "http://secunia.com/advisories/27823",
        "http://secunia.com/advisories/28025",
        "http://secunia.com/advisories/28040",
        "http://secunia.com/advisories/28099",
        "http://secunia.com/advisories/28108",
        "http://secunia.com/advisories/28128",
        "http://secunia.com/advisories/28838",
        "http://security.gentoo.org/glsa/glsa-200711-25.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.428959",
        "http://www.debian.org/security/2007/dsa-1413",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:243",
        "http://www.redhat.com/support/errata/RHSA-2007-1155.html",
        "http://www.redhat.com/support/errata/RHSA-2007-1157.html",
        "http://www.securityfocus.com/bid/26353",
        "http://www.securitytracker.com/id?1018978",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2007/3903",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/38284",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11390",
        "https://usn.ubuntu.com/559-1/",
        "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00467.html",
        "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00475.html",
        "http://bugs.gentoo.org/show_bug.cgi?id=198988",
        "http://bugs.mysql.com/bug.php?id=32125",
        "http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/067350.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html",
        "http://secunia.com/advisories/27568",
        "http://secunia.com/advisories/27649",
        "http://secunia.com/advisories/27823",
        "http://secunia.com/advisories/28025",
        "http://secunia.com/advisories/28040",
        "http://secunia.com/advisories/28099",
        "http://secunia.com/advisories/28108",
        "http://secunia.com/advisories/28128",
        "http://secunia.com/advisories/28838",
        "http://security.gentoo.org/glsa/glsa-200711-25.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.428959",
        "http://www.debian.org/security/2007/dsa-1413",
        "http://www.mandriva.com/security/advisories?name=MDKSA-2007:243",
        "http://www.redhat.com/support/errata/RHSA-2007-1155.html",
        "http://www.redhat.com/support/errata/RHSA-2007-1157.html",
        "http://www.securityfocus.com/bid/26353",
        "http://www.securitytracker.com/id?1018978",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2007/3903",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/38284",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11390",
        "https://usn.ubuntu.com/559-1/",
        "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00467.html",
        "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00475.html"
      ],
      "score": 4,
      "services": [
        "3306/mysql"
      ],
      "severity": "medium",
      "summary": "The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column, which triggers an assertion error.",
      "vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
      "weakness": "CWE-20"
    },
    "CVE-2007-6203": {
      "id": "CVE-2007-6203",
      "references": [
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://procheckup.com/Vulnerability_PR07-37.php",
        "http://secunia.com/advisories/27906",
        "http://secunia.com/advisories/28196",
        "http://secunia.com/advisories/29348",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/30356",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/33105",
        "http://secunia.com/advisories/34219",
        "http://security.gentoo.org/glsa/glsa-200803-19.xml",
        "http://securityreason.com/securityalert/3411",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952",
        "http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html",
        "http://www.securityfocus.com/archive/1/484410/100/0/threaded",
        "http://www.securityfocus.com/bid/26663",
        "http://www.securitytracker.com/id?1019030",
        "http://www.ubuntu.com/usn/USN-731-1",
        "http://www.vupen.com/english/advisories/2007/4060",
        "http://www.vupen.com/english/advisories/2007/4301",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1623/references",
        "http://www.vupen.com/english/advisories/2008/1875/references",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/38800",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a \"413 Request Entity Too Large\" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2007-6388": {
      "id": "CVE-2007-6388",
      "references": [
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28922",
        "http://secunia.com/advisories/28965",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29504",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/29806",
        "http://secunia.com/advisories/29988",
        "http://secunia.com/advisories/30356",
        "http://secunia.com/advisories/30430",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/31142",
        "http://secunia.com/advisories/32800",
        "http://secunia.com/advisories/33200",
        "http://securityreason.com/securityalert/3541",
        "http://securitytracker.com/id?1019154",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
        "http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0007.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/488082/100/0/threaded",
        "http://www.securityfocus.com/archive/1/488082/100/0/threaded",
        "http://www.securityfocus.com/archive/1/494428/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/27237",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2008/0047",
        "http://www.vupen.com/english/advisories/2008/0447/references",
        "http://www.vupen.com/english/advisories/2008/0554",
        "http://www.vupen.com/english/advisories/2008/0809/references",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/0986/references",
        "http://www.vupen.com/english/advisories/2008/1224/references",
        "http://www.vupen.com/english/advisories/2008/1623/references",
        "http://www.vupen.com/english/advisories/2008/1697",
        "http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39472",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://httpd.apache.org/security/vulnerabilities_13.html",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28922",
        "http://secunia.com/advisories/28965",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29504",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/29806",
        "http://secunia.com/advisories/29988",
        "http://secunia.com/advisories/30356",
        "http://secunia.com/advisories/30430",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/31142",
        "http://secunia.com/advisories/32800",
        "http://secunia.com/advisories/33200",
        "http://securityreason.com/securityalert/3541",
        "http://securitytracker.com/id?1019154",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
        "http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0007.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
        "http://www.securityfocus.com/archive/1/488082/100/0/threaded",
        "http://www.securityfocus.com/archive/1/488082/100/0/threaded",
        "http://www.securityfocus.com/archive/1/494428/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498523/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/27237",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
        "http://www.vupen.com/english/advisories/2008/0047",
        "http://www.vupen.com/english/advisories/2008/0447/references",
        "http://www.vupen.com/english/advisories/2008/0554",
        "http://www.vupen.com/english/advisories/2008/0809/references",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/0986/references",
        "http://www.vupen.com/english/advisories/2008/1224/references",
        "http://www.vupen.com/english/advisories/2008/1623/references",
        "http://www.vupen.com/english/advisories/2008/1697",
        "http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39472",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2007-6420": {
      "id": "CVE-2007-6420",
      "references": [
        "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://secunia.com/advisories/31026",
        "http://secunia.com/advisories/32222",
        "http://secunia.com/advisories/33797",
        "http://secunia.com/advisories/34219",
        "http://security.gentoo.org/glsa/glsa-200807-06.xml",
        "http://securityreason.com/securityalert/3523",
        "http://support.apple.com/kb/HT3216",
        "http://www.redhat.com/support/errata/RHSA-2008-0966.html",
        "http://www.securityfocus.com/archive/1/486169/100/0/threaded",
        "http://www.securityfocus.com/archive/1/494858/100/0/threaded",
        "http://www.securityfocus.com/bid/27236",
        "http://www.securityfocus.com/bid/31681",
        "http://www.ubuntu.com/usn/USN-731-1",
        "http://www.vupen.com/english/advisories/2008/2780",
        "http://www.vupen.com/english/advisories/2009/0320",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8371"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-352"
    },
    "CVE-2007-6421": {
      "id": "CVE-2007-6421",
      "references": [
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29640",
        "http://securityreason.com/securityalert/3523",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.securityfocus.com/archive/1/486169/100/0/threaded",
        "http://www.securityfocus.com/bid/27236",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.vupen.com/english/advisories/2008/0048",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39474",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10664",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8651",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
      ],
      "score": 3.5,
      "services": [
        "80/http"
      ],
      "severity": "low",
      "summary": "Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.",
      "vector_string": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2007-6422": {
      "id": "CVE-2007-6422",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29348",
        "http://secunia.com/advisories/29640",
        "http://security.gentoo.org/glsa/glsa-200803-19.xml",
        "http://securityreason.com/securityalert/3523",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.securityfocus.com/archive/1/486169/100/0/threaded",
        "http://www.securityfocus.com/bid/27236",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.vupen.com/english/advisories/2008/0048",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39476",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10181",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8690",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
      ],
      "score": 4,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.",
      "vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
      "weakness": "CWE-399"
    },
    "CVE-2007-6423": {
      "id": "CVE-2007-6423",
      "references": [
        "http://securityreason.com/securityalert/3523",
        "http://www.securityfocus.com/archive/1/486169/100/0/threaded",
        "http://www.securityfocus.com/bid/27236"
      ],
      "score": 7.8,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL.  NOTE: the vendor could not reproduce this issue",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
      "weakness": "CWE-399"
    },
    "CVE-2007-6750": {
      "id": "CVE-2007-6750",
      "references": [
        "http://archives.neohapsis.com/archives/bugtraq/2007-01/0229.html",
        "http://ha.ckers.org/slowloris/",
        "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://www.securityfocus.com/bid/21865",
        "http://www.securitytracker.com/id/1038144",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/72345",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19481",
        "http://archives.neohapsis.com/archives/bugtraq/2007-01/0229.html",
        "http://ha.ckers.org/slowloris/",
        "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://www.securityfocus.com/bid/21865",
        "http://www.securitytracker.com/id/1038144",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/72345",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19481"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-399"
    },
    "CVE-2008-0005": {
      "id": "CVE-2008-0005",
      "references": [
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29348",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/35650",
        "http://security.gentoo.org/glsa/glsa-200803-19.xml",
        "http://securityreason.com/achievement_securityalert/49",
        "http://securityreason.com/securityalert/3526",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0007.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.securityfocus.com/archive/1/486167/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/27234",
        "http://www.securitytracker.com/id?1019185",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1875/references",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39615",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10812",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html",
        "http://docs.info.apple.com/article.html?artnum=307562",
        "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
        "http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://secunia.com/advisories/28467",
        "http://secunia.com/advisories/28471",
        "http://secunia.com/advisories/28526",
        "http://secunia.com/advisories/28607",
        "http://secunia.com/advisories/28749",
        "http://secunia.com/advisories/28977",
        "http://secunia.com/advisories/29348",
        "http://secunia.com/advisories/29420",
        "http://secunia.com/advisories/29640",
        "http://secunia.com/advisories/30732",
        "http://secunia.com/advisories/35650",
        "http://security.gentoo.org/glsa/glsa-200803-19.xml",
        "http://securityreason.com/achievement_securityalert/49",
        "http://securityreason.com/securityalert/3526",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
        "http://www.redhat.com/support/errata/RHSA-2008-0004.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0005.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0006.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0007.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0008.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0009.html",
        "http://www.securityfocus.com/archive/1/486167/100/0/threaded",
        "http://www.securityfocus.com/archive/1/505990/100/0/threaded",
        "http://www.securityfocus.com/bid/27234",
        "http://www.securitytracker.com/id?1019185",
        "http://www.ubuntu.com/usn/usn-575-1",
        "http://www.vupen.com/english/advisories/2008/0924/references",
        "http://www.vupen.com/english/advisories/2008/1875/references",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39615",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10812",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2008-0455": {
      "id": "CVE-2008-0455",
      "references": [
        "http://rhn.redhat.com/errata/RHSA-2012-1591.html",
        "http://rhn.redhat.com/errata/RHSA-2012-1592.html",
        "http://rhn.redhat.com/errata/RHSA-2012-1594.html",
        "http://rhn.redhat.com/errata/RHSA-2013-0130.html",
        "http://secunia.com/advisories/29348",
        "http://secunia.com/advisories/51607",
        "http://security.gentoo.org/glsa/glsa-200803-19.xml",
        "http://securityreason.com/securityalert/3575",
        "http://securitytracker.com/id?1019256",
        "http://www.mindedsecurity.com/MSA01150108.html",
        "http://www.securityfocus.com/archive/1/486847/100/0/threaded",
        "http://www.securityfocus.com/bid/27409",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39867",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) \"406 Not Acceptable\" or (2) \"300 Multiple Choices\" HTTP response when the extension is omitted in a request for the file.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2008-0456": {
      "id": "CVE-2008-0456",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html",
        "http://rhn.redhat.com/errata/RHSA-2013-0130.html",
        "http://secunia.com/advisories/29348",
        "http://secunia.com/advisories/35074",
        "http://security.gentoo.org/glsa/glsa-200803-19.xml",
        "http://securityreason.com/securityalert/3575",
        "http://securitytracker.com/id?1019256",
        "http://support.apple.com/kb/HT3549",
        "http://www.mindedsecurity.com/MSA01150108.html",
        "http://www.securityfocus.com/archive/1/486847/100/0/threaded",
        "http://www.securityfocus.com/bid/27409",
        "http://www.us-cert.gov/cas/techalerts/TA09-133A.html",
        "http://www.vupen.com/english/advisories/2009/1297",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/39893",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 2.6,
      "services": [
        "80/http"
      ],
      "severity": "low",
      "summary": "CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) \"406 Not Acceptable\" or (2) \"300 Multiple Choices\" HTTP response when the extension is omitted in a request for the file.",
      "vector_string": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-74"
    },
    "CVE-2008-2168": {
      "id": "CVE-2008-2168",
      "references": [
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://secunia.com/advisories/31651",
        "http://secunia.com/advisories/34219",
        "http://secunia.com/advisories/35650",
        "http://securityreason.com/securityalert/3889",
        "http://www.securityfocus.com/archive/1/491862/100/0/threaded",
        "http://www.securityfocus.com/archive/1/491901/100/0/threaded",
        "http://www.securityfocus.com/archive/1/491930/100/0/threaded",
        "http://www.securityfocus.com/archive/1/491967/100/0/threaded",
        "http://www.securityfocus.com/bid/29112",
        "http://www.ubuntu.com/usn/USN-731-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/42303",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=124654546101607&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://secunia.com/advisories/31651",
        "http://secunia.com/advisories/34219",
        "http://secunia.com/advisories/35650",
        "http://securityreason.com/securityalert/3889",
        "http://www.securityfocus.com/archive/1/491862/100/0/threaded",
        "http://www.securityfocus.com/archive/1/491901/100/0/threaded",
        "http://www.securityfocus.com/archive/1/491930/100/0/threaded",
        "http://www.securityfocus.com/archive/1/491967/100/0/threaded",
        "http://www.securityfocus.com/bid/29112",
        "http://www.ubuntu.com/usn/USN-731-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/42303",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2008-2364": {
      "id": "CVE-2008-2364",
      "references": [
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://rhn.redhat.com/errata/RHSA-2008-0967.html",
        "http://secunia.com/advisories/30621",
        "http://secunia.com/advisories/31026",
        "http://secunia.com/advisories/31404",
        "http://secunia.com/advisories/31416",
        "http://secunia.com/advisories/31651",
        "http://secunia.com/advisories/31904",
        "http://secunia.com/advisories/32222",
        "http://secunia.com/advisories/32685",
        "http://secunia.com/advisories/32838",
        "http://secunia.com/advisories/33156",
        "http://secunia.com/advisories/33797",
        "http://secunia.com/advisories/34219",
        "http://secunia.com/advisories/34259",
        "http://secunia.com/advisories/34418",
        "http://security.gentoo.org/glsa/glsa-200807-06.xml",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
        "http://support.apple.com/kb/HT3216",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666153&pathrev=666154",
        "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
        "http://www-01.ibm.com/support/docview.wss?uid=swg27008517",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK67579",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:237",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0966.html",
        "http://www.securityfocus.com/archive/1/494858/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498567/100/0/threaded",
        "http://www.securityfocus.com/bid/29653",
        "http://www.securityfocus.com/bid/31681",
        "http://www.securitytracker.com/id?1020267",
        "http://www.ubuntu.com/usn/USN-731-1",
        "http://www.vupen.com/english/advisories/2008/1798",
        "http://www.vupen.com/english/advisories/2008/2780",
        "http://www.vupen.com/english/advisories/2009/0320",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/42987",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11713",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6084",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9577",
        "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00055.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00153.html",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
        "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://rhn.redhat.com/errata/RHSA-2008-0967.html",
        "http://secunia.com/advisories/30621",
        "http://secunia.com/advisories/31026",
        "http://secunia.com/advisories/31404",
        "http://secunia.com/advisories/31416",
        "http://secunia.com/advisories/31651",
        "http://secunia.com/advisories/31904",
        "http://secunia.com/advisories/32222",
        "http://secunia.com/advisories/32685",
        "http://secunia.com/advisories/32838",
        "http://secunia.com/advisories/33156",
        "http://secunia.com/advisories/33797",
        "http://secunia.com/advisories/34219",
        "http://secunia.com/advisories/34259",
        "http://secunia.com/advisories/34418",
        "http://security.gentoo.org/glsa/glsa-200807-06.xml",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
        "http://support.apple.com/kb/HT3216",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666153&pathrev=666154",
        "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
        "http://www-01.ibm.com/support/docview.wss?uid=swg27008517",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK67579",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:237",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0966.html",
        "http://www.securityfocus.com/archive/1/494858/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498567/100/0/threaded",
        "http://www.securityfocus.com/bid/29653",
        "http://www.securityfocus.com/bid/31681",
        "http://www.securitytracker.com/id?1020267",
        "http://www.ubuntu.com/usn/USN-731-1",
        "http://www.vupen.com/english/advisories/2008/1798",
        "http://www.vupen.com/english/advisories/2008/2780",
        "http://www.vupen.com/english/advisories/2009/0320",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/42987",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11713",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6084",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9577",
        "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00055.html",
        "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00153.html"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-770"
    },
    "CVE-2008-2939": {
      "id": "CVE-2008-2939",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://rhn.redhat.com/errata/RHSA-2008-0967.html",
        "http://secunia.com/advisories/31384",
        "http://secunia.com/advisories/31673",
        "http://secunia.com/advisories/32685",
        "http://secunia.com/advisories/32838",
        "http://secunia.com/advisories/33156",
        "http://secunia.com/advisories/33797",
        "http://secunia.com/advisories/34219",
        "http://secunia.com/advisories/35074",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
        "http://support.apple.com/kb/HT3549",
        "http://svn.apache.org/viewvc?view=rev&revision=682868",
        "http://svn.apache.org/viewvc?view=rev&revision=682870",
        "http://svn.apache.org/viewvc?view=rev&revision=682871",
        "http://wiki.rpath.com/Advisories:rPSA-2008-0327",
        "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK70197",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK70937",
        "http://www.kb.cert.org/vuls/id/663763",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:194",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:124",
        "http://www.rapid7.com/advisories/R7-0033",
        "http://www.redhat.com/support/errata/RHSA-2008-0966.html",
        "http://www.securityfocus.com/archive/1/495180/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498566/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498567/100/0/threaded",
        "http://www.securityfocus.com/bid/30560",
        "http://www.securitytracker.com/id?1020635",
        "http://www.ubuntu.com/usn/USN-731-1",
        "http://www.us-cert.gov/cas/techalerts/TA09-133A.html",
        "http://www.vupen.com/english/advisories/2008/2315",
        "http://www.vupen.com/english/advisories/2008/2461",
        "http://www.vupen.com/english/advisories/2009/0320",
        "http://www.vupen.com/english/advisories/2009/1297",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/44223",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11316",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7716",
        "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html",
        "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
        "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
        "http://rhn.redhat.com/errata/RHSA-2008-0967.html",
        "http://secunia.com/advisories/31384",
        "http://secunia.com/advisories/31673",
        "http://secunia.com/advisories/32685",
        "http://secunia.com/advisories/32838",
        "http://secunia.com/advisories/33156",
        "http://secunia.com/advisories/33797",
        "http://secunia.com/advisories/34219",
        "http://secunia.com/advisories/35074",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
        "http://support.apple.com/kb/HT3549",
        "http://svn.apache.org/viewvc?view=rev&revision=682868",
        "http://svn.apache.org/viewvc?view=rev&revision=682870",
        "http://svn.apache.org/viewvc?view=rev&revision=682871",
        "http://wiki.rpath.com/Advisories:rPSA-2008-0327",
        "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK70197",
        "http://www-1.ibm.com/support/docview.wss?uid=swg1PK70937",
        "http://www.kb.cert.org/vuls/id/663763",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:194",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:124",
        "http://www.rapid7.com/advisories/R7-0033",
        "http://www.redhat.com/support/errata/RHSA-2008-0966.html",
        "http://www.securityfocus.com/archive/1/495180/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498566/100/0/threaded",
        "http://www.securityfocus.com/archive/1/498567/100/0/threaded",
        "http://www.securityfocus.com/bid/30560",
        "http://www.securitytracker.com/id?1020635",
        "http://www.ubuntu.com/usn/USN-731-1",
        "http://www.us-cert.gov/cas/techalerts/TA09-133A.html",
        "http://www.vupen.com/english/advisories/2008/2315",
        "http://www.vupen.com/english/advisories/2008/2461",
        "http://www.vupen.com/english/advisories/2009/0320",
        "http://www.vupen.com/english/advisories/2009/1297",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/44223",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11316",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7716"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2008-3259": {
      "id": "CVE-2008-3259",
      "references": [
        "http://openssh.com/security.html",
        "http://secunia.com/advisories/31179",
        "http://www.openssh.com/txt/release-5.1",
        "http://www.securityfocus.com/bid/30339",
        "http://www.securitytracker.com/id?1020537",
        "http://www.vupen.com/english/advisories/2008/2148",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/43940",
        "http://openssh.com/security.html",
        "http://secunia.com/advisories/31179",
        "http://www.openssh.com/txt/release-5.1",
        "http://www.securityfocus.com/bid/30339",
        "http://www.securitytracker.com/id?1020537",
        "http://www.vupen.com/english/advisories/2008/2148",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/43940"
      ],
      "score": 1.2,
      "services": [
        "22/ssh"
      ],
      "severity": "low",
      "summary": "OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.",
      "vector_string": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
      "weakness": "CWE-200"
    },
    "CVE-2008-3844": {
      "id": "CVE-2008-3844",
      "references": [
        "http://secunia.com/advisories/31575",
        "http://secunia.com/advisories/32241",
        "http://securitytracker.com/id?1020730",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
        "http://www.redhat.com/security/data/openssh-blacklist.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0855.html",
        "http://www.securityfocus.com/bid/30794",
        "http://www.vupen.com/english/advisories/2008/2821",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/44747",
        "http://secunia.com/advisories/31575",
        "http://secunia.com/advisories/32241",
        "http://securitytracker.com/id?1020730",
        "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
        "http://www.redhat.com/security/data/openssh-blacklist.html",
        "http://www.redhat.com/support/errata/RHSA-2008-0855.html",
        "http://www.securityfocus.com/bid/30794",
        "http://www.vupen.com/english/advisories/2008/2821",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/44747"
      ],
      "score": 9.3,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known.",
      "vector_string": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
      "weakness": "CWE-20"
    },
    "CVE-2008-4109": {
      "id": "CVE-2008-4109",
      "references": [
        "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498678",
        "http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html",
        "http://secunia.com/advisories/31885",
        "http://secunia.com/advisories/32080",
        "http://secunia.com/advisories/32181",
        "http://www.debian.org/security/2008/dsa-1638",
        "http://www.openwall.com/lists/oss-security/2024/07/01/3",
        "http://www.securitytracker.com/id?1020891",
        "http://www.ubuntu.com/usn/usn-649-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/45202",
        "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498678",
        "http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html",
        "http://secunia.com/advisories/31885",
        "http://secunia.com/advisories/32080",
        "http://secunia.com/advisories/32181",
        "http://www.debian.org/security/2008/dsa-1638",
        "http://www.openwall.com/lists/oss-security/2024/07/01/3",
        "http://www.securitytracker.com/id?1020891",
        "http://www.ubuntu.com/usn/usn-649-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/45202"
      ],
      "score": 5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-264"
    },
    "CVE-2009-0023": {
      "id": "CVE-2009-0023",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://secunia.com/advisories/34724",
        "http://secunia.com/advisories/35284",
        "http://secunia.com/advisories/35360",
        "http://secunia.com/advisories/35395",
        "http://secunia.com/advisories/35444",
        "http://secunia.com/advisories/35487",
        "http://secunia.com/advisories/35565",
        "http://secunia.com/advisories/35710",
        "http://secunia.com/advisories/35797",
        "http://secunia.com/advisories/35843",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-03.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210",
        "http://support.apple.com/kb/HT3937",
        "http://svn.apache.org/viewvc?view=rev&revision=779880",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0144",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
        "http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
        "http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
        "http://www.debian.org/security/2009/dsa-1812",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1107.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1108.html",
        "http://www.securityfocus.com/archive/1/507855/100/0/threaded",
        "http://www.securityfocus.com/bid/35221",
        "http://www.ubuntu.com/usn/usn-786-1",
        "http://www.ubuntu.com/usn/usn-787-1",
        "http://www.vupen.com/english/advisories/2009/1907",
        "http://www.vupen.com/english/advisories/2009/3184",
        "https://bugzilla.redhat.com/show_bug.cgi?id=503928",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/50964",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10968",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12321",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-119"
    },
    "CVE-2009-0819": {
      "id": "CVE-2009-0819",
      "references": [
        "http://bugs.mysql.com/bug.php?id=42495",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html",
        "http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html",
        "http://secunia.com/advisories/34115",
        "http://www.securityfocus.com/bid/33972",
        "http://www.securitytracker.com/id?1021786",
        "http://www.vupen.com/english/advisories/2009/0594",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/49050",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7544",
        "http://bugs.mysql.com/bug.php?id=42495",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html",
        "http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html",
        "http://secunia.com/advisories/34115",
        "http://www.securityfocus.com/bid/33972",
        "http://www.securitytracker.com/id?1021786",
        "http://www.vupen.com/english/advisories/2009/0594",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/49050",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7544"
      ],
      "score": 4,
      "services": [
        "3306/mysql"
      ],
      "severity": "medium",
      "summary": "sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via \"an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML(),\" which triggers an assertion failure.",
      "vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2009-1195": {
      "id": "CVE-2009-1195",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=apache-httpd-dev&m=124048996106302&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://osvdb.org/54733",
        "http://secunia.com/advisories/35261",
        "http://secunia.com/advisories/35264",
        "http://secunia.com/advisories/35395",
        "http://secunia.com/advisories/35453",
        "http://secunia.com/advisories/35721",
        "http://secunia.com/advisories/37152",
        "http://security.gentoo.org/glsa/glsa-200907-04.xml",
        "http://support.apple.com/kb/HT3937",
        "http://svn.apache.org/viewvc?view=rev&revision=772997",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0142",
        "http://www.debian.org/security/2009/dsa-1816",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:124",
        "http://www.redhat.com/support/errata/RHSA-2009-1075.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1156.html",
        "http://www.securityfocus.com/archive/1/507852/100/0/threaded",
        "http://www.securityfocus.com/archive/1/507857/100/0/threaded",
        "http://www.securityfocus.com/bid/35115",
        "http://www.securitytracker.com/id?1022296",
        "http://www.ubuntu.com/usn/usn-787-1",
        "http://www.vupen.com/english/advisories/2009/1444",
        "http://www.vupen.com/english/advisories/2009/3184",
        "https://bugzilla.redhat.com/show_bug.cgi?id=489436",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/50808",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11094",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12377",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8704",
        "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html"
      ],
      "score": 4.9,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.",
      "vector_string": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
      "weakness": "CWE-16"
    },
    "CVE-2009-1890": {
      "id": "CVE-2009-1890",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://osvdb.org/55553",
        "http://secunia.com/advisories/35691",
        "http://secunia.com/advisories/35721",
        "http://secunia.com/advisories/35793",
        "http://secunia.com/advisories/35865",
        "http://secunia.com/advisories/37152",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-04.xml",
        "http://support.apple.com/kb/HT3937",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587",
        "http://svn.apache.org/viewvc?view=rev&revision=790587",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0142",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91259",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480",
        "http://www.debian.org/security/2009/dsa-1834",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:149",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1156.html",
        "http://www.securityfocus.com/archive/1/507852/100/0/threaded",
        "http://www.securityfocus.com/archive/1/507857/100/0/threaded",
        "http://www.securityfocus.com/bid/35565",
        "http://www.securitytracker.com/id?1022509",
        "http://www.ubuntu.com/usn/USN-802-1",
        "http://www.vupen.com/english/advisories/2009/3184",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb33be0aa9bd8cac9536293e3821dcd4cf8180ad95a8036eedd46365e%40%3Cusers.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12330",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8616",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9403",
        "https://rhn.redhat.com/errata/RHSA-2009-1148.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html"
      ],
      "score": 7.1,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
      "weakness": "CWE-400"
    },
    "CVE-2009-1891": {
      "id": "CVE-2009-1891",
      "references": [
        "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712",
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://osvdb.org/55782",
        "http://secunia.com/advisories/35721",
        "http://secunia.com/advisories/35781",
        "http://secunia.com/advisories/35793",
        "http://secunia.com/advisories/35865",
        "http://secunia.com/advisories/37152",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-04.xml",
        "http://support.apple.com/kb/HT3937",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0142",
        "http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91361",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480",
        "http://www.debian.org/security/2009/dsa-1834",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:149",
        "http://www.redhat.com/support/errata/RHSA-2009-1156.html",
        "http://www.securityfocus.com/archive/1/507857/100/0/threaded",
        "http://www.securitytracker.com/id?1022529",
        "http://www.ubuntu.com/usn/USN-802-1",
        "http://www.vupen.com/english/advisories/2009/1841",
        "http://www.vupen.com/english/advisories/2009/3184",
        "https://bugzilla.redhat.com/show_bug.cgi?id=509125",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12361",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8632",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9248",
        "https://rhn.redhat.com/errata/RHSA-2009-1148.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html",
        "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712",
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2",
        "http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://osvdb.org/55782",
        "http://secunia.com/advisories/35721",
        "http://secunia.com/advisories/35781",
        "http://secunia.com/advisories/35793",
        "http://secunia.com/advisories/35865",
        "http://secunia.com/advisories/37152",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-04.xml",
        "http://support.apple.com/kb/HT3937",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0142",
        "http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91361",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480",
        "http://www.debian.org/security/2009/dsa-1834",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:149",
        "http://www.redhat.com/support/errata/RHSA-2009-1156.html",
        "http://www.securityfocus.com/archive/1/507857/100/0/threaded",
        "http://www.securitytracker.com/id?1022529",
        "http://www.ubuntu.com/usn/USN-802-1",
        "http://www.vupen.com/english/advisories/2009/1841",
        "http://www.vupen.com/english/advisories/2009/3184",
        "https://bugzilla.redhat.com/show_bug.cgi?id=509125",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12361",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8632",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9248",
        "https://rhn.redhat.com/errata/RHSA-2009-1148.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html"
      ],
      "score": 7.1,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
      "weakness": "CWE-400"
    },
    "CVE-2009-1955": {
      "id": "CVE-2009-1955",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://marc.info/?l=apr-dev&m=124396021826125&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://secunia.com/advisories/34724",
        "http://secunia.com/advisories/35284",
        "http://secunia.com/advisories/35360",
        "http://secunia.com/advisories/35395",
        "http://secunia.com/advisories/35444",
        "http://secunia.com/advisories/35487",
        "http://secunia.com/advisories/35565",
        "http://secunia.com/advisories/35710",
        "http://secunia.com/advisories/35797",
        "http://secunia.com/advisories/35843",
        "http://secunia.com/advisories/36473",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-03.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210",
        "http://support.apple.com/kb/HT3937",
        "http://svn.apache.org/viewvc?view=rev&revision=781403",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0123",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
        "http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
        "http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
        "http://www.debian.org/security/2009/dsa-1812",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.openwall.com/lists/oss-security/2009/06/03/4",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1107.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1108.html",
        "http://www.securityfocus.com/archive/1/506053/100/0/threaded",
        "http://www.securityfocus.com/bid/35253",
        "http://www.ubuntu.com/usn/usn-786-1",
        "http://www.ubuntu.com/usn/usn-787-1",
        "http://www.vupen.com/english/advisories/2009/1907",
        "http://www.vupen.com/english/advisories/2009/3184",
        "http://www.vupen.com/english/advisories/2010/1107",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473",
        "https://www.exploit-db.com/exploits/8842",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html",
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://marc.info/?l=apr-dev&m=124396021826125&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://secunia.com/advisories/34724",
        "http://secunia.com/advisories/35284",
        "http://secunia.com/advisories/35360",
        "http://secunia.com/advisories/35395",
        "http://secunia.com/advisories/35444",
        "http://secunia.com/advisories/35487",
        "http://secunia.com/advisories/35565",
        "http://secunia.com/advisories/35710",
        "http://secunia.com/advisories/35797",
        "http://secunia.com/advisories/35843",
        "http://secunia.com/advisories/36473",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-03.xml",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210",
        "http://support.apple.com/kb/HT3937",
        "http://svn.apache.org/viewvc?view=rev&revision=781403",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0123",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
        "http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
        "http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
        "http://www.debian.org/security/2009/dsa-1812",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.openwall.com/lists/oss-security/2009/06/03/4",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1107.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1108.html",
        "http://www.securityfocus.com/archive/1/506053/100/0/threaded",
        "http://www.securityfocus.com/bid/35253",
        "http://www.ubuntu.com/usn/usn-786-1",
        "http://www.ubuntu.com/usn/usn-787-1",
        "http://www.vupen.com/english/advisories/2009/1907",
        "http://www.vupen.com/english/advisories/2009/3184",
        "http://www.vupen.com/english/advisories/2010/1107",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473",
        "https://www.exploit-db.com/exploits/8842",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-776"
    },
    "CVE-2009-1956": {
      "id": "CVE-2009-1956",
      "references": [
        "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://secunia.com/advisories/34724",
        "http://secunia.com/advisories/35284",
        "http://secunia.com/advisories/35395",
        "http://secunia.com/advisories/35487",
        "http://secunia.com/advisories/35565",
        "http://secunia.com/advisories/35710",
        "http://secunia.com/advisories/35797",
        "http://secunia.com/advisories/35843",
        "http://secunia.com/advisories/37221",
        "http://security.gentoo.org/glsa/glsa-200907-03.xml",
        "http://support.apple.com/kb/HT3937",
        "http://svn.apache.org/viewvc?view=rev&revision=768417",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
        "http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
        "http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg21591.html",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg21592.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.openwall.com/lists/oss-security/2009/06/06/1",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1107.html",
        "http://www.redhat.com/support/errata/RHSA-2009-1108.html",
        "http://www.securityfocus.com/bid/35251",
        "http://www.ubuntu.com/usn/usn-786-1",
        "http://www.ubuntu.com/usn/usn-787-1",
        "http://www.vupen.com/english/advisories/2009/1907",
        "http://www.vupen.com/english/advisories/2009/3184",
        "https://bugzilla.redhat.com/show_bug.cgi?id=504390",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11567",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12237",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html"
      ],
      "score": 6.4,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
      "weakness": "CWE-189"
    },
    "CVE-2009-2699": {
      "id": "CVE-2009-2699",
      "references": [
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://securitytracker.com/id?1022988",
        "http://www.apache.org/dist/httpd/CHANGES_2.2.14",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.securityfocus.com/bid/36596",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/53666",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=47645",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-667"
    },
    "CVE-2009-2904": {
      "id": "CVE-2009-2904",
      "references": [
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/038214.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
        "http://osvdb.org/58495",
        "http://secunia.com/advisories/38794",
        "http://secunia.com/advisories/38834",
        "http://secunia.com/advisories/39182",
        "http://www.securityfocus.com/bid/36552",
        "http://www.vupen.com/english/advisories/2010/0528",
        "https://bugzilla.redhat.com/show_bug.cgi?id=522141",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9862",
        "https://rhn.redhat.com/errata/RHSA-2009-1470.html"
      ],
      "score": 6.9,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.",
      "vector_string": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
      "weakness": "CWE-16"
    },
    "CVE-2009-3094": {
      "id": "CVE-2009-3094",
      "references": [
        "http://intevydis.com/vd-list.shtml",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=bugtraq&m=126998684522511&w=2",
        "http://marc.info/?l=bugtraq&m=126998684522511&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://secunia.com/advisories/36549",
        "http://secunia.com/advisories/37152",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0155",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK96858",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161",
        "http://www.debian.org/security/2009/dsa-1934",
        "http://www.intevydis.com/blog/?p=59",
        "http://www.securityfocus.com/archive/1/508075/100/0/threaded",
        "http://www.vupen.com/english/advisories/2010/0609",
        "https://bugzilla.redhat.com/show_bug.cgi?id=521619",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10981",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8087",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
        "http://intevydis.com/vd-list.shtml",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=bugtraq&m=126998684522511&w=2",
        "http://marc.info/?l=bugtraq&m=126998684522511&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://secunia.com/advisories/36549",
        "http://secunia.com/advisories/37152",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0155",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PK96858",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161",
        "http://www.debian.org/security/2009/dsa-1934",
        "http://www.intevydis.com/blog/?p=59",
        "http://www.securityfocus.com/archive/1/508075/100/0/threaded",
        "http://www.vupen.com/english/advisories/2010/0609",
        "https://bugzilla.redhat.com/show_bug.cgi?id=521619",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10981",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8087",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html"
      ],
      "score": 2.6,
      "services": [
        "80/http"
      ],
      "severity": "low",
      "summary": "The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.",
      "vector_string": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-476"
    },
    "CVE-2009-3095": {
      "id": "CVE-2009-3095",
      "references": [
        "http://intevydis.com/vd-list.shtml",
        "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=bugtraq&m=126998684522511&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://secunia.com/advisories/37152",
        "http://support.apple.com/kb/HT4077",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0155",
        "http://www.debian.org/security/2009/dsa-1934",
        "http://www.securityfocus.com/archive/1/508075/100/0/threaded",
        "https://bugzilla.redhat.com/show_bug.cgi?id=522209",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8662",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9363",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
        "http://intevydis.com/vd-list.shtml",
        "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
        "http://marc.info/?l=bugtraq&m=126998684522511&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://secunia.com/advisories/37152",
        "http://support.apple.com/kb/HT4077",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0155",
        "http://www.debian.org/security/2009/dsa-1934",
        "http://www.securityfocus.com/archive/1/508075/100/0/threaded",
        "https://bugzilla.redhat.com/show_bug.cgi?id=522209",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8662",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9363",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2009-3555": {
      "id": "CVE-2009-3555",
      "references": [
        "http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html",
        "http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html",
        "http://blogs.iss.net/archive/sslmitmiscsrf.html",
        "http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during",
        "http://clicky.me/tlsvuln",
        "http://extendedsubset.com/?p=8",
        "http://extendedsubset.com/Renegotiating_TLS.pdf",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041",
        "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751",
        "http://kbase.redhat.com/faq/docs/DOC-20491",
        "http://lists.apple.com/archives/security-announce/2010//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2010//May/msg00002.html",
        "http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html",
        "http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html",
        "http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2",
        "http://marc.info/?l=bugtraq&m=126150535619567&w=2",
        "http://marc.info/?l=bugtraq&m=127128920008563&w=2",
        "http://marc.info/?l=bugtraq&m=127419602507642&w=2",
        "http://marc.info/?l=bugtraq&m=127557596201693&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=132077688910227&w=2",
        "http://marc.info/?l=bugtraq&m=133469267822771&w=2",
        "http://marc.info/?l=bugtraq&m=134254866602253&w=2",
        "http://marc.info/?l=bugtraq&m=142660345230545&w=2",
        "http://marc.info/?l=cryptography&m=125752275331877&w=2",
        "http://openbsd.org/errata45.html#010_openssl",
        "http://openbsd.org/errata46.html#004_openssl",
        "http://osvdb.org/60521",
        "http://osvdb.org/60972",
        "http://osvdb.org/62210",
        "http://osvdb.org/65202",
        "http://seclists.org/fulldisclosure/2009/Nov/139",
        "http://secunia.com/advisories/37291",
        "http://secunia.com/advisories/37292",
        "http://secunia.com/advisories/37320",
        "http://secunia.com/advisories/37383",
        "http://secunia.com/advisories/37399",
        "http://secunia.com/advisories/37453",
        "http://secunia.com/advisories/37501",
        "http://secunia.com/advisories/37504",
        "http://secunia.com/advisories/37604",
        "http://secunia.com/advisories/37640",
        "http://secunia.com/advisories/37656",
        "http://secunia.com/advisories/37675",
        "http://secunia.com/advisories/37859",
        "http://secunia.com/advisories/38003",
        "http://secunia.com/advisories/38020",
        "http://secunia.com/advisories/38056",
        "http://secunia.com/advisories/38241",
        "http://secunia.com/advisories/38484",
        "http://secunia.com/advisories/38687",
        "http://secunia.com/advisories/38781",
        "http://secunia.com/advisories/39127",
        "http://secunia.com/advisories/39136",
        "http://secunia.com/advisories/39242",
        "http://secunia.com/advisories/39243",
        "http://secunia.com/advisories/39278",
        "http://secunia.com/advisories/39292",
        "http://secunia.com/advisories/39317",
        "http://secunia.com/advisories/39461",
        "http://secunia.com/advisories/39500",
        "http://secunia.com/advisories/39628",
        "http://secunia.com/advisories/39632",
        "http://secunia.com/advisories/39713",
        "http://secunia.com/advisories/39819",
        "http://secunia.com/advisories/40070",
        "http://secunia.com/advisories/40545",
        "http://secunia.com/advisories/40747",
        "http://secunia.com/advisories/40866",
        "http://secunia.com/advisories/41480",
        "http://secunia.com/advisories/41490",
        "http://secunia.com/advisories/41818",
        "http://secunia.com/advisories/41967",
        "http://secunia.com/advisories/41972",
        "http://secunia.com/advisories/42377",
        "http://secunia.com/advisories/42379",
        "http://secunia.com/advisories/42467",
        "http://secunia.com/advisories/42724",
        "http://secunia.com/advisories/42733",
        "http://secunia.com/advisories/42808",
        "http://secunia.com/advisories/42811",
        "http://secunia.com/advisories/42816",
        "http://secunia.com/advisories/43308",
        "http://secunia.com/advisories/44183",
        "http://secunia.com/advisories/44954",
        "http://secunia.com/advisories/48577",
        "http://security.gentoo.org/glsa/glsa-200912-01.xml",
        "http://security.gentoo.org/glsa/glsa-201203-22.xml",
        "http://security.gentoo.org/glsa/glsa-201406-32.xml",
        "http://securitytracker.com/id?1023148",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1",
        "http://support.apple.com/kb/HT4004",
        "http://support.apple.com/kb/HT4170",
        "http://support.apple.com/kb/HT4171",
        "http://support.avaya.com/css/P8/documents/100070150",
        "http://support.avaya.com/css/P8/documents/100081611",
        "http://support.avaya.com/css/P8/documents/100114315",
        "http://support.avaya.com/css/P8/documents/100114327",
        "http://support.citrix.com/article/CTX123359",
        "http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES",
        "http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released",
        "http://sysoev.ru/nginx/patch.cve-2009-3555.txt",
        "http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html",
        "http://ubuntu.com/usn/usn-923-1",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0155",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21426108",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21432298",
        "http://www-01.ibm.com/support/docview.wss?uid=swg24006386",
        "http://www-01.ibm.com/support/docview.wss?uid=swg24025312",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only",
        "http://www.arubanetworks.com/support/alerts/aid-020810.txt",
        "http://www.betanews.com/article/1257452450",
        "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml",
        "http://www.debian.org/security/2009/dsa-1934",
        "http://www.debian.org/security/2011/dsa-2141",
        "http://www.debian.org/security/2015/dsa-3253",
        "http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html",
        "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html",
        "http://www.ietf.org/mail-archive/web/tls/current/msg03928.html",
        "http://www.ietf.org/mail-archive/web/tls/current/msg03948.html",
        "http://www.ingate.com/Relnote.php?ver=481",
        "http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995",
        "http://www.kb.cert.org/vuls/id/120541",
        "http://www.links.org/?p=780",
        "http://www.links.org/?p=786",
        "http://www.links.org/?p=789",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:076",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
        "http://www.mozilla.org/security/announce/2010/mfsa2010-22.html",
        "http://www.openoffice.org/security/cves/CVE-2009-3555.html",
        "http://www.openssl.org/news/secadv_20091111.txt",
        "http://www.openwall.com/lists/oss-security/2009/11/05/3",
        "http://www.openwall.com/lists/oss-security/2009/11/05/5",
        "http://www.openwall.com/lists/oss-security/2009/11/06/3",
        "http://www.openwall.com/lists/oss-security/2009/11/07/3",
        "http://www.openwall.com/lists/oss-security/2009/11/20/1",
        "http://www.openwall.com/lists/oss-security/2009/11/23/10",
        "http://www.opera.com/docs/changelogs/unix/1060/",
        "http://www.opera.com/support/search/view/944/",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html",
        "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
        "http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html",
        "http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c",
        "http://www.redhat.com/support/errata/RHSA-2010-0119.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0130.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0155.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0165.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0167.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0337.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0338.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0339.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0768.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0770.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0786.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0807.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0865.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0986.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0987.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0880.html",
        "http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html",
        "http://www.securityfocus.com/archive/1/507952/100/0/threaded",
        "http://www.securityfocus.com/archive/1/508075/100/0/threaded",
        "http://www.securityfocus.com/archive/1/508130/100/0/threaded",
        "http://www.securityfocus.com/archive/1/515055/100/0/threaded",
        "http://www.securityfocus.com/archive/1/516397/100/0/threaded",
        "http://www.securityfocus.com/archive/1/522176",
        "http://www.securityfocus.com/bid/36935",
        "http://www.securitytracker.com/id?1023163",
        "http://www.securitytracker.com/id?1023204",
        "http://www.securitytracker.com/id?1023205",
        "http://www.securitytracker.com/id?1023206",
        "http://www.securitytracker.com/id?1023207",
        "http://www.securitytracker.com/id?1023208",
        "http://www.securitytracker.com/id?1023209",
        "http://www.securitytracker.com/id?1023210",
        "http://www.securitytracker.com/id?1023211",
        "http://www.securitytracker.com/id?1023212",
        "http://www.securitytracker.com/id?1023213",
        "http://www.securitytracker.com/id?1023214",
        "http://www.securitytracker.com/id?1023215",
        "http://www.securitytracker.com/id?1023216",
        "http://www.securitytracker.com/id?1023217",
        "http://www.securitytracker.com/id?1023218",
        "http://www.securitytracker.com/id?1023219",
        "http://www.securitytracker.com/id?1023224",
        "http://www.securitytracker.com/id?1023243",
        "http://www.securitytracker.com/id?1023270",
        "http://www.securitytracker.com/id?1023271",
        "http://www.securitytracker.com/id?1023272",
        "http://www.securitytracker.com/id?1023273",
        "http://www.securitytracker.com/id?1023274",
        "http://www.securitytracker.com/id?1023275",
        "http://www.securitytracker.com/id?1023411",
        "http://www.securitytracker.com/id?1023426",
        "http://www.securitytracker.com/id?1023427",
        "http://www.securitytracker.com/id?1023428",
        "http://www.securitytracker.com/id?1024789",
        "http://www.tombom.co.uk/blog/?p=85",
        "http://www.ubuntu.com/usn/USN-1010-1",
        "http://www.ubuntu.com/usn/USN-927-1",
        "http://www.ubuntu.com/usn/USN-927-4",
        "http://www.ubuntu.com/usn/USN-927-5",
        "http://www.us-cert.gov/cas/techalerts/TA10-222A.html",
        "http://www.us-cert.gov/cas/techalerts/TA10-287A.html",
        "http://www.vmware.com/security/advisories/VMSA-2010-0019.html",
        "http://www.vmware.com/security/advisories/VMSA-2011-0003.html",
        "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html",
        "http://www.vupen.com/english/advisories/2009/3164",
        "http://www.vupen.com/english/advisories/2009/3165",
        "http://www.vupen.com/english/advisories/2009/3205",
        "http://www.vupen.com/english/advisories/2009/3220",
        "http://www.vupen.com/english/advisories/2009/3310",
        "http://www.vupen.com/english/advisories/2009/3313",
        "http://www.vupen.com/english/advisories/2009/3353",
        "http://www.vupen.com/english/advisories/2009/3354",
        "http://www.vupen.com/english/advisories/2009/3484",
        "http://www.vupen.com/english/advisories/2009/3521",
        "http://www.vupen.com/english/advisories/2009/3587",
        "http://www.vupen.com/english/advisories/2010/0086",
        "http://www.vupen.com/english/advisories/2010/0173",
        "http://www.vupen.com/english/advisories/2010/0748",
        "http://www.vupen.com/english/advisories/2010/0848",
        "http://www.vupen.com/english/advisories/2010/0916",
        "http://www.vupen.com/english/advisories/2010/0933",
        "http://www.vupen.com/english/advisories/2010/0982",
        "http://www.vupen.com/english/advisories/2010/0994",
        "http://www.vupen.com/english/advisories/2010/1054",
        "http://www.vupen.com/english/advisories/2010/1107",
        "http://www.vupen.com/english/advisories/2010/1191",
        "http://www.vupen.com/english/advisories/2010/1350",
        "http://www.vupen.com/english/advisories/2010/1639",
        "http://www.vupen.com/english/advisories/2010/1673",
        "http://www.vupen.com/english/advisories/2010/1793",
        "http://www.vupen.com/english/advisories/2010/2010",
        "http://www.vupen.com/english/advisories/2010/2745",
        "http://www.vupen.com/english/advisories/2010/3069",
        "http://www.vupen.com/english/advisories/2010/3086",
        "http://www.vupen.com/english/advisories/2010/3126",
        "http://www.vupen.com/english/advisories/2011/0032",
        "http://www.vupen.com/english/advisories/2011/0033",
        "http://www.vupen.com/english/advisories/2011/0086",
        "http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html",
        "https://bugzilla.mozilla.org/show_bug.cgi?id=526689",
        "https://bugzilla.mozilla.org/show_bug.cgi?id=545755",
        "https://bugzilla.redhat.com/show_bug.cgi?id=533125",
        "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/54158",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888",
        "https://kb.bluecoat.com/index?page=content&id=SA50",
        "https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E",
        "https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E",
        "https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E",
        "https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535",
        "https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html",
        "https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html",
        "http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html",
        "http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html",
        "http://blogs.iss.net/archive/sslmitmiscsrf.html",
        "http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during",
        "http://clicky.me/tlsvuln",
        "http://extendedsubset.com/?p=8",
        "http://extendedsubset.com/Renegotiating_TLS.pdf",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041",
        "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751",
        "http://kbase.redhat.com/faq/docs/DOC-20491",
        "http://lists.apple.com/archives/security-announce/2010//May/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2010//May/msg00002.html",
        "http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html",
        "http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html",
        "http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2",
        "http://marc.info/?l=bugtraq&m=126150535619567&w=2",
        "http://marc.info/?l=bugtraq&m=127128920008563&w=2",
        "http://marc.info/?l=bugtraq&m=127419602507642&w=2",
        "http://marc.info/?l=bugtraq&m=127557596201693&w=2",
        "http://marc.info/?l=bugtraq&m=130497311408250&w=2",
        "http://marc.info/?l=bugtraq&m=132077688910227&w=2",
        "http://marc.info/?l=bugtraq&m=133469267822771&w=2",
        "http://marc.info/?l=bugtraq&m=134254866602253&w=2",
        "http://marc.info/?l=bugtraq&m=142660345230545&w=2",
        "http://marc.info/?l=cryptography&m=125752275331877&w=2",
        "http://openbsd.org/errata45.html#010_openssl",
        "http://openbsd.org/errata46.html#004_openssl",
        "http://osvdb.org/60521",
        "http://osvdb.org/60972",
        "http://osvdb.org/62210",
        "http://osvdb.org/65202",
        "http://seclists.org/fulldisclosure/2009/Nov/139",
        "http://secunia.com/advisories/37291",
        "http://secunia.com/advisories/37292",
        "http://secunia.com/advisories/37320",
        "http://secunia.com/advisories/37383",
        "http://secunia.com/advisories/37399",
        "http://secunia.com/advisories/37453",
        "http://secunia.com/advisories/37501",
        "http://secunia.com/advisories/37504",
        "http://secunia.com/advisories/37604",
        "http://secunia.com/advisories/37640",
        "http://secunia.com/advisories/37656",
        "http://secunia.com/advisories/37675",
        "http://secunia.com/advisories/37859",
        "http://secunia.com/advisories/38003",
        "http://secunia.com/advisories/38020",
        "http://secunia.com/advisories/38056",
        "http://secunia.com/advisories/38241",
        "http://secunia.com/advisories/38484",
        "http://secunia.com/advisories/38687",
        "http://secunia.com/advisories/38781",
        "http://secunia.com/advisories/39127",
        "http://secunia.com/advisories/39136",
        "http://secunia.com/advisories/39242",
        "http://secunia.com/advisories/39243",
        "http://secunia.com/advisories/39278",
        "http://secunia.com/advisories/39292",
        "http://secunia.com/advisories/39317",
        "http://secunia.com/advisories/39461",
        "http://secunia.com/advisories/39500",
        "http://secunia.com/advisories/39628",
        "http://secunia.com/advisories/39632",
        "http://secunia.com/advisories/39713",
        "http://secunia.com/advisories/39819",
        "http://secunia.com/advisories/40070",
        "http://secunia.com/advisories/40545",
        "http://secunia.com/advisories/40747",
        "http://secunia.com/advisories/40866",
        "http://secunia.com/advisories/41480",
        "http://secunia.com/advisories/41490",
        "http://secunia.com/advisories/41818",
        "http://secunia.com/advisories/41967",
        "http://secunia.com/advisories/41972",
        "http://secunia.com/advisories/42377",
        "http://secunia.com/advisories/42379",
        "http://secunia.com/advisories/42467",
        "http://secunia.com/advisories/42724",
        "http://secunia.com/advisories/42733",
        "http://secunia.com/advisories/42808",
        "http://secunia.com/advisories/42811",
        "http://secunia.com/advisories/42816",
        "http://secunia.com/advisories/43308",
        "http://secunia.com/advisories/44183",
        "http://secunia.com/advisories/44954",
        "http://secunia.com/advisories/48577",
        "http://security.gentoo.org/glsa/glsa-200912-01.xml",
        "http://security.gentoo.org/glsa/glsa-201203-22.xml",
        "http://security.gentoo.org/glsa/glsa-201406-32.xml",
        "http://securitytracker.com/id?1023148",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1",
        "http://support.apple.com/kb/HT4004",
        "http://support.apple.com/kb/HT4170",
        "http://support.apple.com/kb/HT4171",
        "http://support.avaya.com/css/P8/documents/100070150",
        "http://support.avaya.com/css/P8/documents/100081611",
        "http://support.avaya.com/css/P8/documents/100114315",
        "http://support.avaya.com/css/P8/documents/100114327",
        "http://support.citrix.com/article/CTX123359",
        "http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES",
        "http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released",
        "http://sysoev.ru/nginx/patch.cve-2009-3555.txt",
        "http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html",
        "http://ubuntu.com/usn/usn-923-1",
        "http://wiki.rpath.com/Advisories:rPSA-2009-0155",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21426108",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21432298",
        "http://www-01.ibm.com/support/docview.wss?uid=swg24006386",
        "http://www-01.ibm.com/support/docview.wss?uid=swg24025312",
        "http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only",
        "http://www.arubanetworks.com/support/alerts/aid-020810.txt",
        "http://www.betanews.com/article/1257452450",
        "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml",
        "http://www.debian.org/security/2009/dsa-1934",
        "http://www.debian.org/security/2011/dsa-2141",
        "http://www.debian.org/security/2015/dsa-3253",
        "http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html",
        "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html",
        "http://www.ietf.org/mail-archive/web/tls/current/msg03928.html",
        "http://www.ietf.org/mail-archive/web/tls/current/msg03948.html",
        "http://www.ingate.com/Relnote.php?ver=481",
        "http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995",
        "http://www.kb.cert.org/vuls/id/120541",
        "http://www.links.org/?p=780",
        "http://www.links.org/?p=786",
        "http://www.links.org/?p=789",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:076",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
        "http://www.mozilla.org/security/announce/2010/mfsa2010-22.html",
        "http://www.openoffice.org/security/cves/CVE-2009-3555.html",
        "http://www.openssl.org/news/secadv_20091111.txt",
        "http://www.openwall.com/lists/oss-security/2009/11/05/3",
        "http://www.openwall.com/lists/oss-security/2009/11/05/5",
        "http://www.openwall.com/lists/oss-security/2009/11/06/3",
        "http://www.openwall.com/lists/oss-security/2009/11/07/3",
        "http://www.openwall.com/lists/oss-security/2009/11/20/1",
        "http://www.openwall.com/lists/oss-security/2009/11/23/10",
        "http://www.opera.com/docs/changelogs/unix/1060/",
        "http://www.opera.com/support/search/view/944/",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html",
        "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
        "http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html",
        "http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c",
        "http://www.redhat.com/support/errata/RHSA-2010-0119.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0130.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0155.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0165.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0167.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0337.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0338.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0339.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0768.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0770.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0786.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0807.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0865.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0986.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0987.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0880.html",
        "http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html",
        "http://www.securityfocus.com/archive/1/507952/100/0/threaded",
        "http://www.securityfocus.com/archive/1/508075/100/0/threaded",
        "http://www.securityfocus.com/archive/1/508130/100/0/threaded",
        "http://www.securityfocus.com/archive/1/515055/100/0/threaded",
        "http://www.securityfocus.com/archive/1/516397/100/0/threaded",
        "http://www.securityfocus.com/archive/1/522176",
        "http://www.securityfocus.com/bid/36935",
        "http://www.securitytracker.com/id?1023163",
        "http://www.securitytracker.com/id?1023204",
        "http://www.securitytracker.com/id?1023205",
        "http://www.securitytracker.com/id?1023206",
        "http://www.securitytracker.com/id?1023207",
        "http://www.securitytracker.com/id?1023208",
        "http://www.securitytracker.com/id?1023209",
        "http://www.securitytracker.com/id?1023210",
        "http://www.securitytracker.com/id?1023211",
        "http://www.securitytracker.com/id?1023212",
        "http://www.securitytracker.com/id?1023213",
        "http://www.securitytracker.com/id?1023214",
        "http://www.securitytracker.com/id?1023215",
        "http://www.securitytracker.com/id?1023216",
        "http://www.securitytracker.com/id?1023217",
        "http://www.securitytracker.com/id?1023218",
        "http://www.securitytracker.com/id?1023219",
        "http://www.securitytracker.com/id?1023224",
        "http://www.securitytracker.com/id?1023243",
        "http://www.securitytracker.com/id?1023270",
        "http://www.securitytracker.com/id?1023271",
        "http://www.securitytracker.com/id?1023272",
        "http://www.securitytracker.com/id?1023273",
        "http://www.securitytracker.com/id?1023274",
        "http://www.securitytracker.com/id?1023275",
        "http://www.securitytracker.com/id?1023411",
        "http://www.securitytracker.com/id?1023426",
        "http://www.securitytracker.com/id?1023427",
        "http://www.securitytracker.com/id?1023428",
        "http://www.securitytracker.com/id?1024789",
        "http://www.tombom.co.uk/blog/?p=85",
        "http://www.ubuntu.com/usn/USN-1010-1",
        "http://www.ubuntu.com/usn/USN-927-1",
        "http://www.ubuntu.com/usn/USN-927-4",
        "http://www.ubuntu.com/usn/USN-927-5",
        "http://www.us-cert.gov/cas/techalerts/TA10-222A.html",
        "http://www.us-cert.gov/cas/techalerts/TA10-287A.html",
        "http://www.vmware.com/security/advisories/VMSA-2010-0019.html",
        "http://www.vmware.com/security/advisories/VMSA-2011-0003.html",
        "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html",
        "http://www.vupen.com/english/advisories/2009/3164",
        "http://www.vupen.com/english/advisories/2009/3165",
        "http://www.vupen.com/english/advisories/2009/3205",
        "http://www.vupen.com/english/advisories/2009/3220",
        "http://www.vupen.com/english/advisories/2009/3310",
        "http://www.vupen.com/english/advisories/2009/3313",
        "http://www.vupen.com/english/advisories/2009/3353",
        "http://www.vupen.com/english/advisories/2009/3354",
        "http://www.vupen.com/english/advisories/2009/3484",
        "http://www.vupen.com/english/advisories/2009/3521",
        "http://www.vupen.com/english/advisories/2009/3587",
        "http://www.vupen.com/english/advisories/2010/0086",
        "http://www.vupen.com/english/advisories/2010/0173",
        "http://www.vupen.com/english/advisories/2010/0748",
        "http://www.vupen.com/english/advisories/2010/0848",
        "http://www.vupen.com/english/advisories/2010/0916",
        "http://www.vupen.com/english/advisories/2010/0933",
        "http://www.vupen.com/english/advisories/2010/0982",
        "http://www.vupen.com/english/advisories/2010/0994",
        "http://www.vupen.com/english/advisories/2010/1054",
        "http://www.vupen.com/english/advisories/2010/1107",
        "http://www.vupen.com/english/advisories/2010/1191",
        "http://www.vupen.com/english/advisories/2010/1350",
        "http://www.vupen.com/english/advisories/2010/1639",
        "http://www.vupen.com/english/advisories/2010/1673",
        "http://www.vupen.com/english/advisories/2010/1793",
        "http://www.vupen.com/english/advisories/2010/2010",
        "http://www.vupen.com/english/advisories/2010/2745",
        "http://www.vupen.com/english/advisories/2010/3069",
        "http://www.vupen.com/english/advisories/2010/3086",
        "http://www.vupen.com/english/advisories/2010/3126",
        "http://www.vupen.com/english/advisories/2011/0032",
        "http://www.vupen.com/english/advisories/2011/0033",
        "http://www.vupen.com/english/advisories/2011/0086",
        "http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html",
        "https://bugzilla.mozilla.org/show_bug.cgi?id=526689",
        "https://bugzilla.mozilla.org/show_bug.cgi?id=545755",
        "https://bugzilla.redhat.com/show_bug.cgi?id=533125",
        "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/54158",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888",
        "https://kb.bluecoat.com/index?page=content&id=SA50",
        "https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E",
        "https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E",
        "https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E",
        "https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535",
        "https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html",
        "https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html"
      ],
      "score": 5.8,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
      "weakness": "CWE-295"
    },
    "CVE-2009-3560": {
      "id": "CVE-2009-3560",
      "references": [
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165",
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?view=log#rev1.165",
        "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
        "http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html",
        "http://marc.info/?l=bugtraq&m=130168502603566&w=2",
        "http://secunia.com/advisories/37537",
        "http://secunia.com/advisories/38231",
        "http://secunia.com/advisories/38794",
        "http://secunia.com/advisories/38832",
        "http://secunia.com/advisories/38834",
        "http://secunia.com/advisories/39478",
        "http://secunia.com/advisories/41701",
        "http://secunia.com/advisories/43300",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
        "http://www.debian.org/security/2009/dsa-1953",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:316",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.securityfocus.com/bid/37203",
        "http://www.securitytracker.com/id?1023278",
        "http://www.ubuntu.com/usn/USN-890-1",
        "http://www.ubuntu.com/usn/USN-890-6",
        "http://www.vupen.com/english/advisories/2010/0528",
        "http://www.vupen.com/english/advisories/2010/0896",
        "http://www.vupen.com/english/advisories/2010/1107",
        "http://www.vupen.com/english/advisories/2011/0359",
        "https://bugzilla.redhat.com/show_bug.cgi?id=533174",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10613",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12942",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6883",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00394.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html",
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165",
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?view=log#rev1.165",
        "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
        "http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html",
        "http://marc.info/?l=bugtraq&m=130168502603566&w=2",
        "http://secunia.com/advisories/37537",
        "http://secunia.com/advisories/38231",
        "http://secunia.com/advisories/38794",
        "http://secunia.com/advisories/38832",
        "http://secunia.com/advisories/38834",
        "http://secunia.com/advisories/39478",
        "http://secunia.com/advisories/41701",
        "http://secunia.com/advisories/43300",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
        "http://www.debian.org/security/2009/dsa-1953",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:316",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.securityfocus.com/bid/37203",
        "http://www.securitytracker.com/id?1023278",
        "http://www.ubuntu.com/usn/USN-890-1",
        "http://www.ubuntu.com/usn/USN-890-6",
        "http://www.vupen.com/english/advisories/2010/0528",
        "http://www.vupen.com/english/advisories/2010/0896",
        "http://www.vupen.com/english/advisories/2010/1107",
        "http://www.vupen.com/english/advisories/2011/0359",
        "https://bugzilla.redhat.com/show_bug.cgi?id=533174",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10613",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12942",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6883",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00394.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-119"
    },
    "CVE-2009-3720": {
      "id": "CVE-2009-3720",
      "references": [
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch",
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
        "http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html",
        "http://marc.info/?l=bugtraq&m=130168502603566&w=2",
        "http://secunia.com/advisories/37324",
        "http://secunia.com/advisories/37537",
        "http://secunia.com/advisories/37925",
        "http://secunia.com/advisories/38050",
        "http://secunia.com/advisories/38231",
        "http://secunia.com/advisories/38794",
        "http://secunia.com/advisories/38832",
        "http://secunia.com/advisories/38834",
        "http://secunia.com/advisories/39478",
        "http://secunia.com/advisories/41701",
        "http://secunia.com/advisories/42326",
        "http://secunia.com/advisories/42338",
        "http://secunia.com/advisories/43300",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
        "http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
        "http://svn.python.org/view?view=rev&revision=74429",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:211",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:212",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:215",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:216",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:217",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:218",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:219",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:220",
        "http://www.openwall.com/lists/oss-security/2009/08/21/2",
        "http://www.openwall.com/lists/oss-security/2009/08/26/3",
        "http://www.openwall.com/lists/oss-security/2009/08/26/4",
        "http://www.openwall.com/lists/oss-security/2009/08/27/6",
        "http://www.openwall.com/lists/oss-security/2009/09/06/1",
        "http://www.openwall.com/lists/oss-security/2009/10/22/5",
        "http://www.openwall.com/lists/oss-security/2009/10/22/9",
        "http://www.openwall.com/lists/oss-security/2009/10/23/2",
        "http://www.openwall.com/lists/oss-security/2009/10/23/6",
        "http://www.openwall.com/lists/oss-security/2009/10/26/3",
        "http://www.openwall.com/lists/oss-security/2009/10/28/3",
        "http://www.redhat.com/support/errata/RHSA-2010-0002.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.securitytracker.com/id?1023160",
        "http://www.ubuntu.com/usn/USN-890-1",
        "http://www.ubuntu.com/usn/USN-890-6",
        "http://www.vupen.com/english/advisories/2010/0528",
        "http://www.vupen.com/english/advisories/2010/0896",
        "http://www.vupen.com/english/advisories/2010/1107",
        "http://www.vupen.com/english/advisories/2010/3035",
        "http://www.vupen.com/english/advisories/2010/3053",
        "http://www.vupen.com/english/advisories/2010/3061",
        "http://www.vupen.com/english/advisories/2011/0359",
        "https://bugs.gentoo.org/show_bug.cgi?id=280615",
        "https://bugzilla.redhat.com/show_bug.cgi?id=531697",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11019",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12719",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7112",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01274.html",
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch",
        "http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html",
        "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
        "http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html",
        "http://marc.info/?l=bugtraq&m=130168502603566&w=2",
        "http://secunia.com/advisories/37324",
        "http://secunia.com/advisories/37537",
        "http://secunia.com/advisories/37925",
        "http://secunia.com/advisories/38050",
        "http://secunia.com/advisories/38231",
        "http://secunia.com/advisories/38794",
        "http://secunia.com/advisories/38832",
        "http://secunia.com/advisories/38834",
        "http://secunia.com/advisories/39478",
        "http://secunia.com/advisories/41701",
        "http://secunia.com/advisories/42326",
        "http://secunia.com/advisories/42338",
        "http://secunia.com/advisories/43300",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
        "http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127",
        "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
        "http://svn.python.org/view?view=rev&revision=74429",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:211",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:212",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:215",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:216",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:217",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:218",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:219",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2009:220",
        "http://www.openwall.com/lists/oss-security/2009/08/21/2",
        "http://www.openwall.com/lists/oss-security/2009/08/26/3",
        "http://www.openwall.com/lists/oss-security/2009/08/26/4",
        "http://www.openwall.com/lists/oss-security/2009/08/27/6",
        "http://www.openwall.com/lists/oss-security/2009/09/06/1",
        "http://www.openwall.com/lists/oss-security/2009/10/22/5",
        "http://www.openwall.com/lists/oss-security/2009/10/22/9",
        "http://www.openwall.com/lists/oss-security/2009/10/23/2",
        "http://www.openwall.com/lists/oss-security/2009/10/23/6",
        "http://www.openwall.com/lists/oss-security/2009/10/26/3",
        "http://www.openwall.com/lists/oss-security/2009/10/28/3",
        "http://www.redhat.com/support/errata/RHSA-2010-0002.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.securitytracker.com/id?1023160",
        "http://www.ubuntu.com/usn/USN-890-1",
        "http://www.ubuntu.com/usn/USN-890-6",
        "http://www.vupen.com/english/advisories/2010/0528",
        "http://www.vupen.com/english/advisories/2010/0896",
        "http://www.vupen.com/english/advisories/2010/1107",
        "http://www.vupen.com/english/advisories/2010/3035",
        "http://www.vupen.com/english/advisories/2010/3053",
        "http://www.vupen.com/english/advisories/2010/3061",
        "http://www.vupen.com/english/advisories/2011/0359",
        "https://bugs.gentoo.org/show_bug.cgi?id=280615",
        "https://bugzilla.redhat.com/show_bug.cgi?id=531697",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11019",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12719",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7112",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html",
        "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01274.html"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2010-0408": {
      "id": "CVE-2010-0408",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://secunia.com/advisories/39100",
        "http://secunia.com/advisories/39501",
        "http://secunia.com/advisories/39628",
        "http://secunia.com/advisories/39632",
        "http://secunia.com/advisories/39656",
        "http://secunia.com/advisories/40096",
        "http://support.apple.com/kb/HT4435",
        "http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_ajp.c?r1=917876&r2=917875&pathrev=917876",
        "http://svn.apache.org/viewvc?view=revision&revision=917876",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829",
        "http://www.debian.org/security/2010/dsa-2035",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:053",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0168.html",
        "http://www.securityfocus.com/bid/38491",
        "http://www.vupen.com/english/advisories/2010/0911",
        "http://www.vupen.com/english/advisories/2010/0994",
        "http://www.vupen.com/english/advisories/2010/1001",
        "http://www.vupen.com/english/advisories/2010/1057",
        "http://www.vupen.com/english/advisories/2010/1411",
        "https://bugzilla.redhat.com/show_bug.cgi?id=569905",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8619",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9935"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2010-0425": {
      "id": "CVE-2010-0425",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
        "http://secunia.com/advisories/38978",
        "http://secunia.com/advisories/39628",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870",
        "http://svn.apache.org/viewvc?view=revision&revision=917870",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www.kb.cert.org/vuls/id/280613",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.securityfocus.com/bid/38494",
        "http://www.securitytracker.com/id?1023701",
        "http://www.senseofsecurity.com.au/advisories/SOS-10-002",
        "http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
        "http://www.vupen.com/english/advisories/2010/0634",
        "http://www.vupen.com/english/advisories/2010/0994",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/56624",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8439",
        "https://www.exploit-db.com/exploits/11650",
        "http://httpd.apache.org/security/vulnerabilities_20.html",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
        "http://secunia.com/advisories/38978",
        "http://secunia.com/advisories/39628",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870",
        "http://svn.apache.org/viewvc?view=revision&revision=917870",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www.kb.cert.org/vuls/id/280613",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.securityfocus.com/bid/38494",
        "http://www.securitytracker.com/id?1023701",
        "http://www.senseofsecurity.com.au/advisories/SOS-10-002",
        "http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
        "http://www.vupen.com/english/advisories/2010/0634",
        "http://www.vupen.com/english/advisories/2010/0994",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/56624",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8439",
        "https://www.exploit-db.com/exploits/11650"
      ],
      "score": 10,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and \"orphaned callback pointers.\"",
      "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2010-0434": {
      "id": "CVE-2010-0434",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://secunia.com/advisories/39100",
        "http://secunia.com/advisories/39115",
        "http://secunia.com/advisories/39501",
        "http://secunia.com/advisories/39628",
        "http://secunia.com/advisories/39632",
        "http://secunia.com/advisories/39656",
        "http://secunia.com/advisories/40096",
        "http://support.apple.com/kb/HT4435",
        "http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h",
        "http://svn.apache.org/viewvc?view=revision&revision=917867",
        "http://svn.apache.org/viewvc?view=revision&revision=918427",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829",
        "http://www.debian.org/security/2010/dsa-2035",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0168.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0175.html",
        "http://www.securityfocus.com/bid/38494",
        "http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
        "http://www.vupen.com/english/advisories/2010/0911",
        "http://www.vupen.com/english/advisories/2010/0994",
        "http://www.vupen.com/english/advisories/2010/1001",
        "http://www.vupen.com/english/advisories/2010/1057",
        "http://www.vupen.com/english/advisories/2010/1411",
        "https://bugzilla.redhat.com/show_bug.cgi?id=570171",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/56625",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=48359",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html",
        "http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://marc.info/?l=bugtraq&m=127557640302499&w=2",
        "http://secunia.com/advisories/39100",
        "http://secunia.com/advisories/39115",
        "http://secunia.com/advisories/39501",
        "http://secunia.com/advisories/39628",
        "http://secunia.com/advisories/39632",
        "http://secunia.com/advisories/39656",
        "http://secunia.com/advisories/40096",
        "http://support.apple.com/kb/HT4435",
        "http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h",
        "http://svn.apache.org/viewvc?view=revision&revision=917867",
        "http://svn.apache.org/viewvc?view=revision&revision=918427",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829",
        "http://www.debian.org/security/2010/dsa-2035",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0168.html",
        "http://www.redhat.com/support/errata/RHSA-2010-0175.html",
        "http://www.securityfocus.com/bid/38494",
        "http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
        "http://www.vupen.com/english/advisories/2010/0911",
        "http://www.vupen.com/english/advisories/2010/0994",
        "http://www.vupen.com/english/advisories/2010/1001",
        "http://www.vupen.com/english/advisories/2010/1057",
        "http://www.vupen.com/english/advisories/2010/1411",
        "https://bugzilla.redhat.com/show_bug.cgi?id=570171",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/56625",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=48359",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.",
      "vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
      "weakness": "CWE-200"
    },
    "CVE-2010-1452": {
      "id": "CVE-2010-1452",
      "references": [
        "http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
        "http://marc.info/?l=apache-announce&m=128009718610929&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://secunia.com/advisories/42367",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.467395",
        "http://support.apple.com/kb/HT4581",
        "http://ubuntu.com/usn/usn-1021-1",
        "http://www.redhat.com/support/errata/RHSA-2010-0659.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0897.html",
        "http://www.vupen.com/english/advisories/2010/2218",
        "http://www.vupen.com/english/advisories/2010/3064",
        "http://www.vupen.com/english/advisories/2011/0291",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=49246",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11683",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12341",
        "http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
        "http://marc.info/?l=apache-announce&m=128009718610929&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=129190899612998&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://marc.info/?l=bugtraq&m=133355494609819&w=2",
        "http://secunia.com/advisories/42367",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.467395",
        "http://support.apple.com/kb/HT4581",
        "http://ubuntu.com/usn/usn-1021-1",
        "http://www.redhat.com/support/errata/RHSA-2010-0659.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0897.html",
        "http://www.vupen.com/english/advisories/2010/2218",
        "http://www.vupen.com/english/advisories/2010/3064",
        "http://www.vupen.com/english/advisories/2011/0291",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=49246",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11683",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12341"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2010-1621": {
      "id": "CVE-2010-1621",
      "references": [
        "http://bugs.mysql.com/bug.php?id=51770",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:093",
        "http://www.securityfocus.com/bid/39543",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://bugs.mysql.com/bug.php?id=51770",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:093",
        "http://www.securityfocus.com/bid/39543",
        "http://www.ubuntu.com/usn/USN-1397-1"
      ],
      "score": 5,
      "services": [
        "3306/mysql"
      ],
      "severity": "medium",
      "summary": "The mysql_uninstall_plugin function in sql/sql_plugin.cc in MySQL 5.1 before 5.1.46 does not check privileges before uninstalling a plugin, which allows remote attackers to uninstall arbitrary plugins via the UNINSTALL PLUGIN command.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-264"
    },
    "CVE-2010-1623": {
      "id": "CVE-2010-1623",
      "references": [
        "http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://marc.info/?l=bugtraq&m=130168502603566&w=2",
        "http://secunia.com/advisories/41701",
        "http://secunia.com/advisories/42015",
        "http://secunia.com/advisories/42361",
        "http://secunia.com/advisories/42367",
        "http://secunia.com/advisories/42403",
        "http://secunia.com/advisories/42537",
        "http://secunia.com/advisories/43211",
        "http://secunia.com/advisories/43285",
        "http://security-tracker.debian.org/tracker/CVE-2010-1623",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828",
        "http://svn.apache.org/viewvc?view=revision&revision=1003492",
        "http://svn.apache.org/viewvc?view=revision&revision=1003493",
        "http://svn.apache.org/viewvc?view=revision&revision=1003494",
        "http://svn.apache.org/viewvc?view=revision&revision=1003495",
        "http://svn.apache.org/viewvc?view=revision&revision=1003626",
        "http://ubuntu.com/usn/usn-1021-1",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
        "http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:192",
        "http://www.redhat.com/support/errata/RHSA-2010-0950.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0897.html",
        "http://www.securityfocus.com/bid/43673",
        "http://www.ubuntu.com/usn/USN-1022-1",
        "http://www.vupen.com/english/advisories/2010/2556",
        "http://www.vupen.com/english/advisories/2010/2557",
        "http://www.vupen.com/english/advisories/2010/2806",
        "http://www.vupen.com/english/advisories/2010/3064",
        "http://www.vupen.com/english/advisories/2010/3065",
        "http://www.vupen.com/english/advisories/2010/3074",
        "http://www.vupen.com/english/advisories/2011/0358",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800",
        "http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://marc.info/?l=bugtraq&m=130168502603566&w=2",
        "http://secunia.com/advisories/41701",
        "http://secunia.com/advisories/42015",
        "http://secunia.com/advisories/42361",
        "http://secunia.com/advisories/42367",
        "http://secunia.com/advisories/42403",
        "http://secunia.com/advisories/42537",
        "http://secunia.com/advisories/43211",
        "http://secunia.com/advisories/43285",
        "http://security-tracker.debian.org/tracker/CVE-2010-1623",
        "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828",
        "http://svn.apache.org/viewvc?view=revision&revision=1003492",
        "http://svn.apache.org/viewvc?view=revision&revision=1003493",
        "http://svn.apache.org/viewvc?view=revision&revision=1003494",
        "http://svn.apache.org/viewvc?view=revision&revision=1003495",
        "http://svn.apache.org/viewvc?view=revision&revision=1003626",
        "http://ubuntu.com/usn/usn-1021-1",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
        "http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
        "http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:192",
        "http://www.redhat.com/support/errata/RHSA-2010-0950.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0897.html",
        "http://www.securityfocus.com/bid/43673",
        "http://www.ubuntu.com/usn/USN-1022-1",
        "http://www.vupen.com/english/advisories/2010/2556",
        "http://www.vupen.com/english/advisories/2010/2557",
        "http://www.vupen.com/english/advisories/2010/2806",
        "http://www.vupen.com/english/advisories/2010/3064",
        "http://www.vupen.com/english/advisories/2010/3065",
        "http://www.vupen.com/english/advisories/2010/3074",
        "http://www.vupen.com/english/advisories/2011/0358",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-119"
    },
    "CVE-2010-1626": {
      "id": "CVE-2010-1626",
      "references": [
        "http://bugs.mysql.com/bug.php?id=40980",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html",
        "http://securitytracker.com/id?1024004",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:101",
        "http://www.openwall.com/lists/oss-security/2010/05/10/2",
        "http://www.openwall.com/lists/oss-security/2010/05/18/4",
        "http://www.redhat.com/support/errata/RHSA-2010-0442.html",
        "http://www.securityfocus.com/bid/40257",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2010/1194",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9490",
        "http://bugs.mysql.com/bug.php?id=40980",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html",
        "http://securitytracker.com/id?1024004",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:101",
        "http://www.openwall.com/lists/oss-security/2010/05/10/2",
        "http://www.openwall.com/lists/oss-security/2010/05/18/4",
        "http://www.redhat.com/support/errata/RHSA-2010-0442.html",
        "http://www.securityfocus.com/bid/40257",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2010/1194",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9490"
      ],
      "score": 3.6,
      "services": [
        "3306/mysql"
      ],
      "severity": "low",
      "summary": "MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.",
      "vector_string": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
      "weakness": "CWE-59"
    },
    "CVE-2010-3677": {
      "id": "CVE-2010-3677",
      "references": [
        "http://bugs.mysql.com/bug.php?id=54575",
        "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html",
        "http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://secunia.com/advisories/42875",
        "http://secunia.com/advisories/42936",
        "http://support.apple.com/kb/HT4723",
        "http://www.debian.org/security/2011/dsa-2143",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:155",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:222",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:012",
        "http://www.openwall.com/lists/oss-security/2010/09/28/10",
        "http://www.redhat.com/support/errata/RHSA-2010-0825.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0164.html",
        "http://www.securityfocus.com/bid/42646",
        "http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txt",
        "http://www.ubuntu.com/usn/USN-1017-1",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2011/0105",
        "http://www.vupen.com/english/advisories/2011/0133",
        "http://www.vupen.com/english/advisories/2011/0170",
        "http://www.vupen.com/english/advisories/2011/0345",
        "https://bugzilla.redhat.com/show_bug.cgi?id=628040",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/64688",
        "http://bugs.mysql.com/bug.php?id=54575",
        "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html",
        "http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://secunia.com/advisories/42875",
        "http://secunia.com/advisories/42936",
        "http://support.apple.com/kb/HT4723",
        "http://www.debian.org/security/2011/dsa-2143",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:155",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:222",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:012",
        "http://www.openwall.com/lists/oss-security/2010/09/28/10",
        "http://www.redhat.com/support/errata/RHSA-2010-0825.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0164.html",
        "http://www.securityfocus.com/bid/42646",
        "http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txt",
        "http://www.ubuntu.com/usn/USN-1017-1",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2011/0105",
        "http://www.vupen.com/english/advisories/2011/0133",
        "http://www.vupen.com/english/advisories/2011/0170",
        "http://www.vupen.com/english/advisories/2011/0345",
        "https://bugzilla.redhat.com/show_bug.cgi?id=628040",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/64688"
      ],
      "score": 4,
      "services": [
        "3306/mysql"
      ],
      "severity": "medium",
      "summary": "Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.",
      "vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
      "weakness": "CWE-399"
    },
    "CVE-2010-3682": {
      "id": "CVE-2010-3682",
      "references": [
        "http://bugs.mysql.com/bug.php?id=52711",
        "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html",
        "http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://secunia.com/advisories/42875",
        "http://secunia.com/advisories/42936",
        "http://support.apple.com/kb/HT4723",
        "http://www.debian.org/security/2011/dsa-2143",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:155",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:222",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:012",
        "http://www.openwall.com/lists/oss-security/2010/09/28/10",
        "http://www.redhat.com/support/errata/RHSA-2010-0825.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0164.html",
        "http://www.securityfocus.com/bid/42599",
        "http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txt",
        "http://www.ubuntu.com/usn/USN-1017-1",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2011/0105",
        "http://www.vupen.com/english/advisories/2011/0133",
        "http://www.vupen.com/english/advisories/2011/0170",
        "http://www.vupen.com/english/advisories/2011/0345",
        "https://bugzilla.redhat.com/show_bug.cgi?id=628328",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/64684",
        "http://bugs.mysql.com/bug.php?id=52711",
        "http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html",
        "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html",
        "http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html",
        "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
        "http://secunia.com/advisories/42875",
        "http://secunia.com/advisories/42936",
        "http://support.apple.com/kb/HT4723",
        "http://www.debian.org/security/2011/dsa-2143",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:155",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2010:222",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:012",
        "http://www.openwall.com/lists/oss-security/2010/09/28/10",
        "http://www.redhat.com/support/errata/RHSA-2010-0825.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0164.html",
        "http://www.securityfocus.com/bid/42599",
        "http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txt",
        "http://www.ubuntu.com/usn/USN-1017-1",
        "http://www.ubuntu.com/usn/USN-1397-1",
        "http://www.vupen.com/english/advisories/2011/0105",
        "http://www.vupen.com/english/advisories/2011/0133",
        "http://www.vupen.com/english/advisories/2011/0170",
        "http://www.vupen.com/english/advisories/2011/0345",
        "https://bugzilla.redhat.com/show_bug.cgi?id=628328",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/64684"
      ],
      "score": 4,
      "services": [
        "3306/mysql"
      ],
      "severity": "medium",
      "summary": "Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted \"SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)\" statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function.",
      "vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2010-4478": {
      "id": "CVE-2010-4478",
      "references": [
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673",
        "http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c#rev1.5",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c.diff?r1=1.4%3Br2=1.5%3Bf=h",
        "https://bugzilla.redhat.com/show_bug.cgi?id=659297",
        "https://github.com/seb-m/jpake",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12338",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673",
        "http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c#rev1.5",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c.diff?r1=1.4%3Br2=1.5%3Bf=h",
        "https://bugzilla.redhat.com/show_bug.cgi?id=659297",
        "https://github.com/seb-m/jpake",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12338"
      ],
      "score": 7.5,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "weakness": "CWE-287"
    },
    "CVE-2010-4755": {
      "id": "CVE-2010-4755",
      "references": [
        "http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c#rev1.13.12.1",
        "http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp.c#rev1.21.6.1",
        "http://cxib.net/stuff/glob-0day.c",
        "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-008.txt.asc",
        "http://securityreason.com/achievement_securityalert/89",
        "http://securityreason.com/exploitalert/9223",
        "http://securityreason.com/securityalert/8116",
        "http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c#rev1.13.12.1",
        "http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp.c#rev1.21.6.1",
        "http://cxib.net/stuff/glob-0day.c",
        "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-008.txt.asc",
        "http://securityreason.com/achievement_securityalert/89",
        "http://securityreason.com/exploitalert/9223",
        "http://securityreason.com/securityalert/8116"
      ],
      "score": 4,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.",
      "vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
      "weakness": "CWE-399"
    },
    "CVE-2010-5107": {
      "id": "CVE-2010-5107",
      "references": [
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://rhn.redhat.com/errata/RHSA-2013-1591.html",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev1.234",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#rev1.156",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev1.89",
        "http://www.openwall.com/lists/oss-security/2013/02/07/3",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/bid/58162",
        "https://bugzilla.redhat.com/show_bug.cgi?id=908707",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19515",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19595",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://rhn.redhat.com/errata/RHSA-2013-1591.html",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev1.234",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#rev1.156",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev1.89",
        "http://www.openwall.com/lists/oss-security/2013/02/07/3",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/bid/58162",
        "https://bugzilla.redhat.com/show_bug.cgi?id=908707",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19515",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19595"
      ],
      "score": 5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2011-0419": {
      "id": "CVE-2011-0419",
      "references": [
        "http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22",
        "http://cxib.net/stuff/apache.fnmatch.phps",
        "http://cxib.net/stuff/apr_fnmatch.txts",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://marc.info/?l=bugtraq&m=131551295528105&w=2",
        "http://marc.info/?l=bugtraq&m=131731002122529&w=2",
        "http://marc.info/?l=bugtraq&m=132033751509019&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://secunia.com/advisories/44490",
        "http://secunia.com/advisories/44564",
        "http://secunia.com/advisories/44574",
        "http://secunia.com/advisories/48308",
        "http://securityreason.com/achievement_securityalert/98",
        "http://securityreason.com/securityalert/8246",
        "http://securitytracker.com/id?1025527",
        "http://support.apple.com/kb/HT5002",
        "http://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902",
        "http://svn.apache.org/viewvc?view=revision&revision=1098188",
        "http://svn.apache.org/viewvc?view=revision&revision=1098799",
        "http://www.apache.org/dist/apr/Announcement1.x.html",
        "http://www.apache.org/dist/apr/CHANGES-APR-1.4",
        "http://www.apache.org/dist/httpd/Announcement2.2.html",
        "http://www.debian.org/security/2011/dsa-2237",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg23960.html",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg23961.html",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg23976.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:084",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fnmatch.c#rev1.15",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0507.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0897.html",
        "https://bugzilla.redhat.com/show_bug.cgi?id=703390",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804",
        "http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22",
        "http://cxib.net/stuff/apache.fnmatch.phps",
        "http://cxib.net/stuff/apr_fnmatch.txts",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://marc.info/?l=bugtraq&m=131551295528105&w=2",
        "http://marc.info/?l=bugtraq&m=131731002122529&w=2",
        "http://marc.info/?l=bugtraq&m=132033751509019&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://secunia.com/advisories/44490",
        "http://secunia.com/advisories/44564",
        "http://secunia.com/advisories/44574",
        "http://secunia.com/advisories/48308",
        "http://securityreason.com/achievement_securityalert/98",
        "http://securityreason.com/securityalert/8246",
        "http://securitytracker.com/id?1025527",
        "http://support.apple.com/kb/HT5002",
        "http://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902",
        "http://svn.apache.org/viewvc?view=revision&revision=1098188",
        "http://svn.apache.org/viewvc?view=revision&revision=1098799",
        "http://www.apache.org/dist/apr/Announcement1.x.html",
        "http://www.apache.org/dist/apr/CHANGES-APR-1.4",
        "http://www.apache.org/dist/httpd/Announcement2.2.html",
        "http://www.debian.org/security/2011/dsa-2237",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg23960.html",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg23961.html",
        "http://www.mail-archive.com/dev%40apr.apache.org/msg23976.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:084",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fnmatch.c#rev1.15",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0507.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0896.html",
        "http://www.redhat.com/support/errata/RHSA-2011-0897.html",
        "https://bugzilla.redhat.com/show_bug.cgi?id=703390",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-770"
    },
    "CVE-2011-3192": {
      "id": "CVE-2011-3192",
      "references": [
        "http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html",
        "http://blogs.oracle.com/security/entry/security_alert_for_cve_2011",
        "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110824161640.122D387DD%40minotaur.apache.org%3e",
        "http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g%40mail.gmail.com%3e",
        "http://marc.info/?l=bugtraq&m=131551295528105&w=2",
        "http://marc.info/?l=bugtraq&m=131551295528105&w=2",
        "http://marc.info/?l=bugtraq&m=131731002122529&w=2",
        "http://marc.info/?l=bugtraq&m=131731002122529&w=2",
        "http://marc.info/?l=bugtraq&m=132033751509019&w=2",
        "http://marc.info/?l=bugtraq&m=132033751509019&w=2",
        "http://marc.info/?l=bugtraq&m=133477473521382&w=2",
        "http://marc.info/?l=bugtraq&m=133477473521382&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://osvdb.org/74721",
        "http://seclists.org/fulldisclosure/2011/Aug/175",
        "http://secunia.com/advisories/45606",
        "http://secunia.com/advisories/45937",
        "http://secunia.com/advisories/46000",
        "http://secunia.com/advisories/46125",
        "http://secunia.com/advisories/46126",
        "http://securitytracker.com/id?1025960",
        "http://support.apple.com/kb/HT5002",
        "http://www.apache.org/dist/httpd/Announcement2.2.html",
        "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml",
        "http://www.exploit-db.com/exploits/17696",
        "http://www.gossamer-threads.com/lists/apache/dev/401638",
        "http://www.kb.cert.org/vuls/id/405811",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:130",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1245.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1294.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1300.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1329.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1330.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1369.html",
        "http://www.securityfocus.com/bid/49303",
        "http://www.ubuntu.com/usn/USN-1199-1",
        "https://bugzilla.redhat.com/show_bug.cgi?id=732928",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/69396",
        "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=51714",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14762",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14824",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18827",
        "http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html",
        "http://blogs.oracle.com/security/entry/security_alert_for_cve_2011",
        "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110824161640.122D387DD%40minotaur.apache.org%3e",
        "http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g%40mail.gmail.com%3e",
        "http://marc.info/?l=bugtraq&m=131551295528105&w=2",
        "http://marc.info/?l=bugtraq&m=131551295528105&w=2",
        "http://marc.info/?l=bugtraq&m=131731002122529&w=2",
        "http://marc.info/?l=bugtraq&m=131731002122529&w=2",
        "http://marc.info/?l=bugtraq&m=132033751509019&w=2",
        "http://marc.info/?l=bugtraq&m=132033751509019&w=2",
        "http://marc.info/?l=bugtraq&m=133477473521382&w=2",
        "http://marc.info/?l=bugtraq&m=133477473521382&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://osvdb.org/74721",
        "http://seclists.org/fulldisclosure/2011/Aug/175",
        "http://secunia.com/advisories/45606",
        "http://secunia.com/advisories/45937",
        "http://secunia.com/advisories/46000",
        "http://secunia.com/advisories/46125",
        "http://secunia.com/advisories/46126",
        "http://securitytracker.com/id?1025960",
        "http://support.apple.com/kb/HT5002",
        "http://www.apache.org/dist/httpd/Announcement2.2.html",
        "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml",
        "http://www.exploit-db.com/exploits/17696",
        "http://www.gossamer-threads.com/lists/apache/dev/401638",
        "http://www.kb.cert.org/vuls/id/405811",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:130",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1245.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1294.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1300.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1329.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1330.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1369.html",
        "http://www.securityfocus.com/bid/49303",
        "http://www.ubuntu.com/usn/USN-1199-1",
        "https://bugzilla.redhat.com/show_bug.cgi?id=732928",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/69396",
        "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
        "https://issues.apache.org/bugzilla/show_bug.cgi?id=51714",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14762",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14824",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18827"
      ],
      "score": 7.8,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
      "weakness": "CWE-400"
    },
    "CVE-2011-3368": {
      "id": "CVE-2011-3368",
      "references": [
        "http://kb.juniper.net/JSA10585",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://osvdb.org/76079",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://seclists.org/fulldisclosure/2011/Oct/232",
        "http://seclists.org/fulldisclosure/2011/Oct/273",
        "http://secunia.com/advisories/46288",
        "http://secunia.com/advisories/46414",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://svn.apache.org/viewvc?view=revision&revision=1179239",
        "http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt",
        "http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42",
        "http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48",
        "http://www.contextis.com/research/blog/reverseproxybypass/",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.exploit-db.com/exploits/17969",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:144",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1391.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1392.html",
        "http://www.securityfocus.com/bid/49957",
        "http://www.securitytracker.com/id?1026144",
        "https://bugzilla.redhat.com/show_bug.cgi?id=740045",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/70336",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "http://kb.juniper.net/JSA10585",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://osvdb.org/76079",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://seclists.org/fulldisclosure/2011/Oct/232",
        "http://seclists.org/fulldisclosure/2011/Oct/273",
        "http://secunia.com/advisories/46288",
        "http://secunia.com/advisories/46414",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://svn.apache.org/viewvc?view=revision&revision=1179239",
        "http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt",
        "http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42",
        "http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48",
        "http://www.contextis.com/research/blog/reverseproxybypass/",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.exploit-db.com/exploits/17969",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2011:144",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1391.html",
        "http://www.redhat.com/support/errata/RHSA-2011-1392.html",
        "http://www.securityfocus.com/bid/49957",
        "http://www.securitytracker.com/id?1026144",
        "https://bugzilla.redhat.com/show_bug.cgi?id=740045",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/70336",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "weakness": "CWE-20"
    },
    "CVE-2011-3607": {
      "id": "CVE-2011-3607",
      "references": [
        "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://secunia.com/advisories/45793",
        "http://secunia.com/advisories/48551",
        "http://securitytracker.com/id?1026267",
        "http://support.apple.com/kb/HT5501",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.osvdb.org/76744",
        "http://www.securityfocus.com/bid/50494",
        "https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422",
        "https://bugzilla.redhat.com/show_bug.cgi?id=750935",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/71093",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://secunia.com/advisories/45793",
        "http://secunia.com/advisories/48551",
        "http://securitytracker.com/id?1026267",
        "http://support.apple.com/kb/HT5501",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.osvdb.org/76744",
        "http://www.securityfocus.com/bid/50494",
        "https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422",
        "https://bugzilla.redhat.com/show_bug.cgi?id=750935",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/71093",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 4.4,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.",
      "vector_string": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
      "weakness": "CWE-189"
    },
    "CVE-2011-3639": {
      "id": "CVE-2011-3639",
      "references": [
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://svn.apache.org/viewvc?view=revision&revision=1188745",
        "http://www.debian.org/security/2012/dsa-2405",
        "https://bugzilla.redhat.com/show_bug.cgi?id=752080",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://svn.apache.org/viewvc?view=revision&revision=1188745",
        "http://www.debian.org/security/2012/dsa-2405",
        "https://bugzilla.redhat.com/show_bug.cgi?id=752080"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-20"
    },
    "CVE-2011-4317": {
      "id": "CVE-2011-4317",
      "references": [
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://kb.juniper.net/JSA10585",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://thread.gmane.org/gmane.comp.apache.devel/46440",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.securitytracker.com/id?1026353",
        "https://bugzilla.redhat.com/show_bug.cgi?id=756483",
        "https://community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://kb.juniper.net/JSA10585",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://thread.gmane.org/gmane.comp.apache.devel/46440",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.securitytracker.com/id?1026353",
        "https://bugzilla.redhat.com/show_bug.cgi?id=756483",
        "https://community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-20"
    },
    "CVE-2011-4327": {
      "id": "CVE-2011-4327",
      "references": [
        "http://www.openssh.com/txt/portable-keysign-rand-helper.adv",
        "https://bugzilla.redhat.com/show_bug.cgi?id=755640",
        "http://www.openssh.com/txt/portable-keysign-rand-helper.adv",
        "https://bugzilla.redhat.com/show_bug.cgi?id=755640"
      ],
      "score": 2.1,
      "services": [
        "22/ssh"
      ],
      "severity": "low",
      "summary": "ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.",
      "vector_string": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
      "weakness": "CWE-200"
    },
    "CVE-2011-4415": {
      "id": "CVE-2011-4415",
      "references": [
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://www.gossamer-threads.com/lists/apache/dev/403775",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://www.gossamer-threads.com/lists/apache/dev/403775",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
        "http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html"
      ],
      "score": 1.2,
      "services": [
        "80/http"
      ],
      "severity": "low",
      "summary": "The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the \"len +=\" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.",
      "vector_string": "AV:L/AC:H/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-20"
    },
    "CVE-2011-5000": {
      "id": "CVE-2011-5000",
      "references": [
        "http://rhn.redhat.com/errata/RHSA-2012-0884.html",
        "http://seclists.org/fulldisclosure/2011/Aug/2",
        "http://site.pi3.com.pl/adv/ssh_1.txt",
        "http://rhn.redhat.com/errata/RHSA-2012-0884.html",
        "http://seclists.org/fulldisclosure/2011/Aug/2",
        "http://site.pi3.com.pl/adv/ssh_1.txt"
      ],
      "score": 3.5,
      "services": [
        "22/ssh"
      ],
      "severity": "low",
      "summary": "The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field.  NOTE: there may be limited scenarios in which this issue is relevant.",
      "vector_string": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
      "weakness": "CWE-189"
    },
    "CVE-2012-0031": {
      "id": "CVE-2012-0031",
      "references": [
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://secunia.com/advisories/47410",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://svn.apache.org/viewvc?view=revision&revision=1230065",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.securityfocus.com/bid/51407",
        "https://bugzilla.redhat.com/show_bug.cgi?id=773744",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://marc.info/?l=bugtraq&m=134987041210674&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://secunia.com/advisories/47410",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://svn.apache.org/viewvc?view=revision&revision=1230065",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.securityfocus.com/bid/51407",
        "https://bugzilla.redhat.com/show_bug.cgi?id=773744",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 4.6,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.",
      "vector_string": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2012-0053": {
      "id": "CVE-2012-0053",
      "references": [
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://kb.juniper.net/JSA10585",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=136441204617335&w=2",
        "http://marc.info/?l=bugtraq&m=136441204617335&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://svn.apache.org/viewvc?view=revision&revision=1235454",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.securityfocus.com/bid/51706",
        "https://bugzilla.redhat.com/show_bug.cgi?id=785069",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://kb.juniper.net/JSA10585",
        "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
        "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133294460209056&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133494237717847&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=133951357207000&w=2",
        "http://marc.info/?l=bugtraq&m=136441204617335&w=2",
        "http://marc.info/?l=bugtraq&m=136441204617335&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-0128.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0542.html",
        "http://rhn.redhat.com/errata/RHSA-2012-0543.html",
        "http://secunia.com/advisories/48551",
        "http://support.apple.com/kb/HT5501",
        "http://svn.apache.org/viewvc?view=revision&revision=1235454",
        "http://www.debian.org/security/2012/dsa-2405",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
        "http://www.securityfocus.com/bid/51706",
        "https://bugzilla.redhat.com/show_bug.cgi?id=785069",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.",
      "vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2012-0814": {
      "id": "CVE-2012-0814",
      "references": [
        "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673",
        "http://openwall.com/lists/oss-security/2012/01/26/15",
        "http://openwall.com/lists/oss-security/2012/01/26/16",
        "http://openwall.com/lists/oss-security/2012/01/27/1",
        "http://openwall.com/lists/oss-security/2012/01/27/4",
        "http://osvdb.org/78706",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54",
        "http://www.securityfocus.com/bid/51702",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/72756",
        "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673",
        "http://openwall.com/lists/oss-security/2012/01/26/15",
        "http://openwall.com/lists/oss-security/2012/01/26/16",
        "http://openwall.com/lists/oss-security/2012/01/27/1",
        "http://openwall.com/lists/oss-security/2012/01/27/4",
        "http://osvdb.org/78706",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54",
        "http://www.securityfocus.com/bid/51702",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/72756"
      ],
      "score": 3.5,
      "services": [
        "22/ssh"
      ],
      "severity": "low",
      "summary": "The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite.  NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.",
      "vector_string": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
      "weakness": "CWE-255"
    },
    "CVE-2012-0883": {
      "id": "CVE-2012-0883",
      "references": [
        "http://article.gmane.org/gmane.comp.apache.devel/48158",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://marc.info/?l=bugtraq&m=134012830914727&w=2",
        "http://secunia.com/advisories/48849",
        "http://support.apple.com/kb/HT5880",
        "http://svn.apache.org/viewvc?view=revision&revision=1296428",
        "http://www.apache.org/dist/httpd/Announcement2.4.html",
        "http://www.apachelounge.com/Changelog-2.4.html",
        "http://www.securityfocus.com/bid/53046",
        "http://www.securitytracker.com/id?1026932",
        "http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/74901",
        "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
      ],
      "score": 6.9,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.",
      "vector_string": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2012-2687": {
      "id": "CVE-2012-2687",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00011.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://mail-archives.apache.org/mod_mbox/www-announce/201208.mbox/%3C0BFFEA9B-801B-4BAA-9534-56F640268E30%40apache.org%3E",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-1591.html",
        "http://rhn.redhat.com/errata/RHSA-2012-1592.html",
        "http://rhn.redhat.com/errata/RHSA-2012-1594.html",
        "http://rhn.redhat.com/errata/RHSA-2013-0130.html",
        "http://secunia.com/advisories/50894",
        "http://secunia.com/advisories/51607",
        "http://support.apple.com/kb/HT5880",
        "http://www-01.ibm.com/support/docview.wss?uid=nas2a2b50a0ca011b37c86257a96003c9a4f",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.3",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.securityfocus.com/bid/55131",
        "http://www.ubuntu.com/usn/USN-1627-1",
        "http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18832",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19539",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00011.html",
        "http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
        "http://mail-archives.apache.org/mod_mbox/www-announce/201208.mbox/%3C0BFFEA9B-801B-4BAA-9534-56F640268E30%40apache.org%3E",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://rhn.redhat.com/errata/RHSA-2012-1591.html",
        "http://rhn.redhat.com/errata/RHSA-2012-1592.html",
        "http://rhn.redhat.com/errata/RHSA-2012-1594.html",
        "http://rhn.redhat.com/errata/RHSA-2013-0130.html",
        "http://secunia.com/advisories/50894",
        "http://secunia.com/advisories/51607",
        "http://support.apple.com/kb/HT5880",
        "http://www-01.ibm.com/support/docview.wss?uid=nas2a2b50a0ca011b37c86257a96003c9a4f",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.3",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
        "http://www.securityfocus.com/bid/55131",
        "http://www.ubuntu.com/usn/USN-1627-1",
        "http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18832",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19539"
      ],
      "score": 2.6,
      "services": [
        "80/http"
      ],
      "severity": "low",
      "summary": "Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.",
      "vector_string": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2012-3499": {
      "id": "CVE-2012-3499",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://rhn.redhat.com/errata/RHSA-2013-0815.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://secunia.com/advisories/55032",
        "http://support.apple.com/kb/HT5880",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_info.c?r1=1225799&r2=1413732&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1389564&r2=1413732&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/util_ldap_cache_mgr.c?r1=1209766&r2=1418752&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_imagemap.c?r1=1398480&r2=1413732&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c?r1=1404625&r2=1413732&diff_format=h",
        "http://www.debian.org/security/2013/dsa-2637",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
        "http://www.securityfocus.com/bid/58165",
        "http://www.securityfocus.com/bid/64758",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19312",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://rhn.redhat.com/errata/RHSA-2013-0815.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://secunia.com/advisories/55032",
        "http://support.apple.com/kb/HT5880",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_info.c?r1=1225799&r2=1413732&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1389564&r2=1413732&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/util_ldap_cache_mgr.c?r1=1209766&r2=1418752&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_imagemap.c?r1=1398480&r2=1413732&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c?r1=1404625&r2=1413732&diff_format=h",
        "http://www.debian.org/security/2013/dsa-2637",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
        "http://www.securityfocus.com/bid/58165",
        "http://www.securityfocus.com/bid/64758",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19312"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2012-4558": {
      "id": "CVE-2012-4558",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://rhn.redhat.com/errata/RHSA-2013-0815.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://support.apple.com/kb/HT5880",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c?r1=1404653&r2=1413732&diff_format=h",
        "http://www.debian.org/security/2013/dsa-2637",
        "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
        "http://www.securityfocus.com/bid/58165",
        "http://www.securityfocus.com/bid/64758",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18977",
        "http://httpd.apache.org/security/vulnerabilities_22.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://marc.info/?l=bugtraq&m=136612293908376&w=2",
        "http://rhn.redhat.com/errata/RHSA-2013-0815.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://support.apple.com/kb/HT5880",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c?r1=1404653&r2=1413732&diff_format=h",
        "http://www.debian.org/security/2013/dsa-2637",
        "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
        "http://www.securityfocus.com/bid/58165",
        "http://www.securityfocus.com/bid/64758",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18977"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-79"
    },
    "CVE-2013-1862": {
      "id": "CVE-2013-1862",
      "references": [
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html",
        "http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch",
        "http://rhn.redhat.com/errata/RHSA-2013-0815.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://secunia.com/advisories/55032",
        "http://support.apple.com/kb/HT6150",
        "http://svn.apache.org/viewvc?view=revision&revision=r1469311",
        "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:174",
        "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
        "http://www.securityfocus.com/bid/59826",
        "http://www.securityfocus.com/bid/64758",
        "http://www.ubuntu.com/usn/USN-1903-1",
        "https://bugzilla.redhat.com/show_bug.cgi?id=953729",
        "https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
        "https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html",
        "http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch",
        "http://rhn.redhat.com/errata/RHSA-2013-0815.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://secunia.com/advisories/55032",
        "http://support.apple.com/kb/HT6150",
        "http://svn.apache.org/viewvc?view=revision&revision=r1469311",
        "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
        "http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2013:174",
        "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
        "http://www.securityfocus.com/bid/59826",
        "http://www.securityfocus.com/bid/64758",
        "http://www.ubuntu.com/usn/USN-1903-1",
        "https://bugzilla.redhat.com/show_bug.cgi?id=953729",
        "https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
        "https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
        "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534"
      ],
      "score": 5.1,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.",
      "vector_string": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2013-1896": {
      "id": "CVE-2013-1896",
      "references": [
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html",
        "http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1156.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1207.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1208.html",
        "http://rhn.redhat.com/errata/RHSA-2013-1209.html",
        "http://secunia.com/advisories/55032",
        "http://support.apple.com/kb/HT6150",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log",
        "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1896",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
        "http://www.apache.org/dist/httpd/Announcement2.2.html",
        "http://www.securityfocus.com/bid/61129",
        "http://www.ubuntu.com/usn/USN-1903-1",
        "https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18835",
        "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19747"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2013-5704": {
      "id": "CVE-2013-5704",
      "references": [
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
        "http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://martin.swende.se/blog/HTTPChunked.html",
        "http://rhn.redhat.com/errata/RHSA-2015-0325.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1249.html",
        "http://rhn.redhat.com/errata/RHSA-2015-2661.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0061.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0062.html",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:174",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/bid/66550",
        "http://www.ubuntu.com/usn/USN-2523-1",
        "https://access.redhat.com/errata/RHSA-2015:2659",
        "https://access.redhat.com/errata/RHSA-2015:2660",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201504-03",
        "https://support.apple.com/HT204659",
        "https://support.apple.com/HT205219",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
        "http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://martin.swende.se/blog/HTTPChunked.html",
        "http://rhn.redhat.com/errata/RHSA-2015-0325.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1249.html",
        "http://rhn.redhat.com/errata/RHSA-2015-2661.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0061.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0062.html",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:174",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/bid/66550",
        "http://www.ubuntu.com/usn/USN-2523-1",
        "https://access.redhat.com/errata/RHSA-2015:2659",
        "https://access.redhat.com/errata/RHSA-2015:2660",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201504-03",
        "https://support.apple.com/HT204659",
        "https://support.apple.com/HT205219"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states \"this is not a security issue in httpd as such.\"",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2013-6438": {
      "id": "CVE-2013-6438",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0135.html",
        "http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://marc.info/?l=bugtraq&m=141017844705317&w=2",
        "http://marc.info/?l=bugtraq&m=141390017113542&w=2",
        "http://seclists.org/fulldisclosure/2014/Dec/23",
        "http://secunia.com/advisories/58230",
        "http://secunia.com/advisories/59315",
        "http://secunia.com/advisories/59345",
        "http://secunia.com/advisories/60536",
        "http://security.gentoo.org/glsa/glsa-201408-12.xml",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c?r1=1528718&r2=1556428&diff_format=h",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21669554",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21676091",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21676092",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.9",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
        "http://www.securityfocus.com/archive/1/534161/100/0/threaded",
        "http://www.securityfocus.com/bid/66303",
        "http://www.ubuntu.com/usn/USN-2152-1",
        "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
        "https://blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/cve-2013-6438",
        "https://support.apple.com/HT204659",
        "https://support.apple.com/kb/HT6535"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2014-0098": {
      "id": "CVE-2014-0098",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0135.html",
        "http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://marc.info/?l=bugtraq&m=141017844705317&w=2",
        "http://marc.info/?l=bugtraq&m=141390017113542&w=2",
        "http://seclists.org/fulldisclosure/2014/Dec/23",
        "http://secunia.com/advisories/58230",
        "http://secunia.com/advisories/58915",
        "http://secunia.com/advisories/59219",
        "http://secunia.com/advisories/59315",
        "http://secunia.com/advisories/59345",
        "http://secunia.com/advisories/60536",
        "http://security.gentoo.org/glsa/glsa-201408-12.xml",
        "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15320.html",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21668973",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21676091",
        "http://www-01.ibm.com/support/docview.wss?uid=swg21676092",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.9",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
        "http://www.securityfocus.com/archive/1/534161/100/0/threaded",
        "http://www.securityfocus.com/bid/66303",
        "http://www.ubuntu.com/usn/USN-2152-1",
        "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
        "https://blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/cve-2014-0098",
        "https://support.apple.com/HT204659",
        "https://support.apple.com/kb/HT6535"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2014-0118": {
      "id": "CVE-2014-0118",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0304.html",
        "http://advisories.mageia.org/MGASA-2014-0305.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=143748090628601&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://rhn.redhat.com/errata/RHSA-2014-1019.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1020.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1021.html",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c?r1=1604353&r2=1610501&diff_format=h",
        "http://www.debian.org/security/2014/dsa-2989",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.securityfocus.com/bid/68745",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1120601",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/cve-2014-0118",
        "https://security.gentoo.org/glsa/201504-03",
        "https://support.apple.com/HT204659"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-400"
    },
    "CVE-2014-0226": {
      "id": "CVE-2014-0226",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0304.html",
        "http://advisories.mageia.org/MGASA-2014-0305.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=143748090628601&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://rhn.redhat.com/errata/RHSA-2014-1019.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1020.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1021.html",
        "http://seclists.org/fulldisclosure/2014/Jul/114",
        "http://secunia.com/advisories/60536",
        "http://security.gentoo.org/glsa/glsa-201408-12.xml",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=h",
        "http://www.debian.org/security/2014/dsa-2989",
        "http://www.exploit-db.com/exploits/34133",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.osvdb.org/109216",
        "http://www.securityfocus.com/bid/68678",
        "http://zerodayinitiative.com/advisories/ZDI-14-236/",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1120603",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/cve-2014-0226",
        "https://security.gentoo.org/glsa/201504-03",
        "https://support.apple.com/HT204659",
        "https://www.povonsec.com/apache-2-4-7-exploit/"
      ],
      "score": 6.8,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.",
      "vector_string": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "weakness": "CWE-362"
    },
    "CVE-2014-0231": {
      "id": "CVE-2014-0231",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0304.html",
        "http://advisories.mageia.org/MGASA-2014-0305.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=143748090628601&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1019.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1020.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1021.html",
        "http://secunia.com/advisories/60536",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=h",
        "http://www.debian.org/security/2014/dsa-2989",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.securityfocus.com/bid/68742",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1120596",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/cve-2014-0231",
        "https://security.gentoo.org/glsa/201504-03",
        "https://support.apple.com/HT204659",
        "http://advisories.mageia.org/MGASA-2014-0304.html",
        "http://advisories.mageia.org/MGASA-2014-0305.html",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
        "http://marc.info/?l=bugtraq&m=143748090628601&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1019.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1020.html",
        "http://rhn.redhat.com/errata/RHSA-2014-1021.html",
        "http://secunia.com/advisories/60536",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=h",
        "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=h",
        "http://www.debian.org/security/2014/dsa-2989",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
        "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
        "http://www.securityfocus.com/bid/68742",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1120596",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/cve-2014-0231",
        "https://security.gentoo.org/glsa/201504-03",
        "https://support.apple.com/HT204659"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-399"
    },
    "CVE-2014-1692": {
      "id": "CVE-2014-1692",
      "references": [
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://openwall.com/lists/oss-security/2014/01/29/10",
        "http://openwall.com/lists/oss-security/2014/01/29/2",
        "http://osvdb.org/102611",
        "http://secunia.com/advisories/60184",
        "http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9%3Br2=1.10%3Bf=h",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10",
        "http://www.securityfocus.com/bid/65230",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/90819",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://openwall.com/lists/oss-security/2014/01/29/10",
        "http://openwall.com/lists/oss-security/2014/01/29/2",
        "http://osvdb.org/102611",
        "http://secunia.com/advisories/60184",
        "http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9%3Br2=1.10%3Bf=h",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10",
        "http://www.securityfocus.com/bid/65230",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/90819"
      ],
      "score": 7.5,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "weakness": "CWE-119"
    },
    "CVE-2014-2532": {
      "id": "CVE-2014-2532",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0143.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://secunia.com/advisories/57488",
        "http://secunia.com/advisories/57574",
        "http://secunia.com/advisories/59313",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
        "http://www.securityfocus.com/bid/66355",
        "http://www.securitytracker.com/id/1029925",
        "http://www.ubuntu.com/usn/USN-2155-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/91986",
        "https://support.apple.com/HT205267",
        "http://advisories.mageia.org/MGASA-2014-0143.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://secunia.com/advisories/57488",
        "http://secunia.com/advisories/57574",
        "http://secunia.com/advisories/59313",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
        "http://www.securityfocus.com/bid/66355",
        "http://www.securitytracker.com/id/1029925",
        "http://www.ubuntu.com/usn/USN-2155-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/91986",
        "https://support.apple.com/HT205267"
      ],
      "score": 4.9,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.",
      "vector_string": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "weakness": "CWE-264"
    },
    "CVE-2014-2653": {
      "id": "CVE-2014-2653",
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0166.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://openwall.com/lists/oss-security/2014/03/26/7",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://rhn.redhat.com/errata/RHSA-2015-0425.html",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.securityfocus.com/bid/66459",
        "http://www.ubuntu.com/usn/USN-2164-1",
        "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513",
        "http://advisories.mageia.org/MGASA-2014-0166.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://openwall.com/lists/oss-security/2014/03/26/7",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://rhn.redhat.com/errata/RHSA-2015-0425.html",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.securityfocus.com/bid/66459",
        "http://www.ubuntu.com/usn/USN-2164-1",
        "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513"
      ],
      "score": 5.8,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.",
      "vector_string": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
      "weakness": "CWE-20"
    },
    "CVE-2015-0228": {
      "id": "CVE-2015-0228",
      "references": [
        "http://advisories.mageia.org/MGASA-2015-0099.html",
        "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-updates/2015-03/msg00006.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1666.html",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/CHANGES",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/bid/73041",
        "http://www.securityfocus.com/bid/91787",
        "http://www.securitytracker.com/id/1032967",
        "http://www.ubuntu.com/usn/USN-2523-1",
        "https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef",
        "https://github.com/apache/httpd/commit/78eb3b9235515652ed141353d98c239237030410",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://support.apple.com/HT205219",
        "https://support.apple.com/kb/HT205031",
        "http://advisories.mageia.org/MGASA-2015-0099.html",
        "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-updates/2015-03/msg00006.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1666.html",
        "http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/CHANGES",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/bid/73041",
        "http://www.securityfocus.com/bid/91787",
        "http://www.securitytracker.com/id/1032967",
        "http://www.ubuntu.com/usn/USN-2523-1",
        "https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef",
        "https://github.com/apache/httpd/commit/78eb3b9235515652ed141353d98c239237030410",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://support.apple.com/HT205219",
        "https://support.apple.com/kb/HT205031"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "weakness": "CWE-20"
    },
    "CVE-2015-2575": {
      "id": "CVE-2015-2575",
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html",
        "http://lists.opensuse.org/opensuse-updates/2015-05/msg00089.html",
        "http://www.debian.org/security/2016/dsa-3621",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html",
        "http://www.securityfocus.com/bid/74075",
        "http://www.securitytracker.com/id/1032121",
        "https://security.netapp.com/advisory/ntap-20150417-0003/",
        "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html",
        "http://lists.opensuse.org/opensuse-updates/2015-05/msg00089.html",
        "http://www.debian.org/security/2016/dsa-3621",
        "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html",
        "http://www.securityfocus.com/bid/74075",
        "http://www.securitytracker.com/id/1032121",
        "https://security.netapp.com/advisory/ntap-20150417-0003/"
      ],
      "score": 4.9,
      "services": [
        "3306/mysql"
      ],
      "severity": "medium",
      "summary": "Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.",
      "vector_string": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2015-3183": {
      "id": "CVE-2015-3183",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735",
        "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://rhn.redhat.com/errata/RHSA-2015-1666.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1667.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1668.html",
        "http://rhn.redhat.com/errata/RHSA-2015-2661.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0061.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0062.html",
        "http://rhn.redhat.com/errata/RHSA-2016-2054.html",
        "http://rhn.redhat.com/errata/RHSA-2016-2055.html",
        "http://rhn.redhat.com/errata/RHSA-2016-2056.html",
        "http://www.apache.org/dist/httpd/CHANGES_2.4",
        "http://www.debian.org/security/2015/dsa-3325",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
        "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
        "http://www.securityfocus.com/bid/75963",
        "http://www.securityfocus.com/bid/91787",
        "http://www.securitytracker.com/id/1032967",
        "http://www.ubuntu.com/usn/USN-2686-1",
        "https://access.redhat.com/errata/RHSA-2015:2659",
        "https://access.redhat.com/errata/RHSA-2015:2660",
        "https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6",
        "https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/CVE-2015-3183",
        "https://security.gentoo.org/glsa/201610-02",
        "https://support.apple.com/HT205219",
        "https://support.apple.com/kb/HT205031",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735",
        "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
        "http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
        "http://rhn.redhat.com/errata/RHSA-2015-1666.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1667.html",
        "http://rhn.redhat.com/errata/RHSA-2015-1668.html",
        "http://rhn.redhat.com/errata/RHSA-2015-2661.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0061.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0062.html",
        "http://rhn.redhat.com/errata/RHSA-2016-2054.html",
        "http://rhn.redhat.com/errata/RHSA-2016-2055.html",
        "http://rhn.redhat.com/errata/RHSA-2016-2056.html",
        "http://www.apache.org/dist/httpd/CHANGES_2.4",
        "http://www.debian.org/security/2015/dsa-3325",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
        "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
        "http://www.securityfocus.com/bid/75963",
        "http://www.securityfocus.com/bid/91787",
        "http://www.securitytracker.com/id/1032967",
        "http://www.ubuntu.com/usn/USN-2686-1",
        "https://access.redhat.com/errata/RHSA-2015:2659",
        "https://access.redhat.com/errata/RHSA-2015:2660",
        "https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6",
        "https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://puppet.com/security/cve/CVE-2015-3183",
        "https://security.gentoo.org/glsa/201610-02",
        "https://support.apple.com/HT205219",
        "https://support.apple.com/kb/HT205031"
      ],
      "score": 5,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.",
      "vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-17"
    },
    "CVE-2015-5352": {
      "id": "CVE-2015-5352",
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://openwall.com/lists/oss-security/2015/07/01/10",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://www.openssh.com/txt/release-6.9",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.securityfocus.com/bid/75525",
        "http://www.securitytracker.com/id/1032797",
        "http://www.ubuntu.com/usn/USN-2710-1",
        "http://www.ubuntu.com/usn/USN-2710-2",
        "https://anongit.mindrot.org/openssh.git/commit/?h=V_6_9&id=1bf477d3cdf1a864646d59820878783d42357a1d",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://security.netapp.com/advisory/ntap-20181023-0001/",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://openwall.com/lists/oss-security/2015/07/01/10",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://www.openssh.com/txt/release-6.9",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.securityfocus.com/bid/75525",
        "http://www.securitytracker.com/id/1032797",
        "http://www.ubuntu.com/usn/USN-2710-1",
        "http://www.ubuntu.com/usn/USN-2710-2",
        "https://anongit.mindrot.org/openssh.git/commit/?h=V_6_9&id=1bf477d3cdf1a864646d59820878783d42357a1d",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://security.netapp.com/advisory/ntap-20181023-0001/"
      ],
      "score": 4.3,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.",
      "vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-264"
    },
    "CVE-2015-5600": {
      "id": "CVE-2015-5600",
      "references": [
        "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c",
        "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697",
        "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.html",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://openwall.com/lists/oss-security/2015/07/23/4",
        "http://rhn.redhat.com/errata/RHSA-2016-0466.html",
        "http://seclists.org/fulldisclosure/2015/Jul/92",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
        "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html",
        "http://www.securityfocus.com/bid/75990",
        "http://www.securityfocus.com/bid/91787",
        "http://www.securityfocus.com/bid/92012",
        "http://www.securitytracker.com/id/1032988",
        "http://www.ubuntu.com/usn/USN-2710-1",
        "http://www.ubuntu.com/usn/USN-2710-2",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10136",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10157",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://security.netapp.com/advisory/ntap-20151106-0001/",
        "https://support.apple.com/kb/HT205031",
        "https://www.arista.com/en/support/advisories-notices/security-advisories/1174-security-advisory-12",
        "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c",
        "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h",
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697",
        "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.html",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://openwall.com/lists/oss-security/2015/07/23/4",
        "http://rhn.redhat.com/errata/RHSA-2016-0466.html",
        "http://seclists.org/fulldisclosure/2015/Jul/92",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
        "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html",
        "http://www.securityfocus.com/bid/75990",
        "http://www.securityfocus.com/bid/91787",
        "http://www.securityfocus.com/bid/92012",
        "http://www.securitytracker.com/id/1032988",
        "http://www.ubuntu.com/usn/USN-2710-1",
        "http://www.ubuntu.com/usn/USN-2710-2",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10136",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10157",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://security.netapp.com/advisory/ntap-20151106-0001/",
        "https://support.apple.com/kb/HT205031",
        "https://www.arista.com/en/support/advisories-notices/security-advisories/1174-security-advisory-12"
      ],
      "score": 8.5,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.",
      "vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:C",
      "weakness": "CWE-264"
    },
    "CVE-2015-6563": {
      "id": "CVE-2015-6563",
      "references": [
        "http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://seclists.org/fulldisclosure/2015/Aug/54",
        "http://www.openssh.com/txt/release-7.0",
        "http://www.openwall.com/lists/oss-security/2015/08/22/1",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
        "http://www.securityfocus.com/bid/76317",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://security.netapp.com/advisory/ntap-20180201-0002/",
        "https://support.apple.com/HT205375",
        "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-766",
        "http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://seclists.org/fulldisclosure/2015/Aug/54",
        "http://www.openssh.com/txt/release-7.0",
        "http://www.openwall.com/lists/oss-security/2015/08/22/1",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
        "http://www.securityfocus.com/bid/76317",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://security.netapp.com/advisory/ntap-20180201-0002/",
        "https://support.apple.com/HT205375",
        "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-766"
      ],
      "score": 1.8,
      "services": [
        "22/ssh"
      ],
      "severity": "low",
      "summary": "The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.",
      "vector_string": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
      "weakness": "CWE-20"
    },
    "CVE-2015-6564": {
      "id": "CVE-2015-6564",
      "references": [
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://seclists.org/fulldisclosure/2015/Aug/54",
        "http://www.openssh.com/txt/release-7.0",
        "http://www.openwall.com/lists/oss-security/2015/08/22/1",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
        "http://www.securityfocus.com/bid/76317",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10136",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-764",
        "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html",
        "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://seclists.org/fulldisclosure/2015/Aug/54",
        "http://www.openssh.com/txt/release-7.0",
        "http://www.openwall.com/lists/oss-security/2015/08/22/1",
        "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
        "http://www.securityfocus.com/bid/76317",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10136",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201512-04",
        "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-764"
      ],
      "score": 6.9,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.",
      "vector_string": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
      "weakness": "CWE-264"
    },
    "CVE-2016-10009": {
      "id": "CVE-2016-10009",
      "references": [
        "http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html",
        "http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html",
        "http://seclists.org/fulldisclosure/2023/Jul/31",
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.openwall.com/lists/oss-security/2023/07/19/9",
        "http://www.openwall.com/lists/oss-security/2023/07/20/1",
        "http://www.securityfocus.com/bid/94968",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://access.redhat.com/errata/RHSA-2017:2029",
        "https://bugs.chromium.org/p/project-zero/issues/detail?id=1009",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://usn.ubuntu.com/3538-1/",
        "https://www.exploit-db.com/exploits/40963/",
        "https://www.openssh.com/txt/release-7.4",
        "http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html",
        "http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html",
        "http://seclists.org/fulldisclosure/2023/Jul/31",
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.openwall.com/lists/oss-security/2023/07/19/9",
        "http://www.openwall.com/lists/oss-security/2023/07/20/1",
        "http://www.securityfocus.com/bid/94968",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://access.redhat.com/errata/RHSA-2017:2029",
        "https://bugs.chromium.org/p/project-zero/issues/detail?id=1009",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://usn.ubuntu.com/3538-1/",
        "https://www.exploit-db.com/exploits/40963/",
        "https://www.openssh.com/txt/release-7.4"
      ],
      "score": 7.3,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "weakness": "CWE-426"
    },
    "CVE-2016-10010": {
      "id": "CVE-2016-10010",
      "references": [
        "http://packetstormsecurity.com/files/140262/OpenSSH-Local-Privilege-Escalation.html",
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.securityfocus.com/bid/94972",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://bugs.chromium.org/p/project-zero/issues/detail?id=1010",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce",
        "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://www.exploit-db.com/exploits/40962/",
        "https://www.openssh.com/txt/release-7.4",
        "http://packetstormsecurity.com/files/140262/OpenSSH-Local-Privilege-Escalation.html",
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.securityfocus.com/bid/94972",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://bugs.chromium.org/p/project-zero/issues/detail?id=1010",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce",
        "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://www.exploit-db.com/exploits/40962/",
        "https://www.openssh.com/txt/release-7.4"
      ],
      "score": 7,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.",
      "vector_string": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-264"
    },
    "CVE-2016-10011": {
      "id": "CVE-2016-10011",
      "references": [
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.securityfocus.com/bid/94977",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://access.redhat.com/errata/RHSA-2017:2029",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf",
        "https://github.com/openbsd/src/commit/ac8147a06ed2e2403fb6b9a0c03e618a9333c0e9",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://www.openssh.com/txt/release-7.4",
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.securityfocus.com/bid/94977",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://access.redhat.com/errata/RHSA-2017:2029",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf",
        "https://github.com/openbsd/src/commit/ac8147a06ed2e2403fb6b9a0c03e618a9333c0e9",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://www.openssh.com/txt/release-7.4"
      ],
      "score": 5.5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.",
      "vector_string": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "weakness": "CWE-320"
    },
    "CVE-2016-10012": {
      "id": "CVE-2016-10012",
      "references": [
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.securityfocus.com/bid/94975",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://access.redhat.com/errata/RHSA-2017:2029",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.f5.com/csp/article/K62201745?utm_source=f5support&amp%3Butm_medium=RSS",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://www.openssh.com/txt/release-7.4",
        "http://www.openwall.com/lists/oss-security/2016/12/19/2",
        "http://www.securityfocus.com/bid/94975",
        "http://www.securitytracker.com/id/1037490",
        "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637",
        "https://access.redhat.com/errata/RHSA-2017:2029",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20171130-0002/",
        "https://support.f5.com/csp/article/K62201745?utm_source=f5support&amp%3Butm_medium=RSS",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
        "https://www.openssh.com/txt/release-7.4"
      ],
      "score": 7.8,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.",
      "vector_string": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-119"
    },
    "CVE-2016-10708": {
      "id": "CVE-2016-10708",
      "references": [
        "http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html",
        "http://www.securityfocus.com/bid/102780",
        "https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
        "https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20180423-0003/",
        "https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS",
        "https://usn.ubuntu.com/3809-1/",
        "https://www.openssh.com/releasenotes.html",
        "http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html",
        "http://www.securityfocus.com/bid/102780",
        "https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
        "https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20180423-0003/",
        "https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS",
        "https://usn.ubuntu.com/3809-1/",
        "https://www.openssh.com/releasenotes.html"
      ],
      "score": 7.5,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-476"
    },
    "CVE-2016-1908": {
      "id": "CVE-2016-1908",
      "references": [
        "http://openwall.com/lists/oss-security/2016/01/15/13",
        "http://rhn.redhat.com/errata/RHSA-2016-0465.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://www.openssh.com/txt/release-7.2",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.securityfocus.com/bid/84427",
        "http://www.securitytracker.com/id/1034705",
        "https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1298741",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201612-18",
        "http://openwall.com/lists/oss-security/2016/01/15/13",
        "http://rhn.redhat.com/errata/RHSA-2016-0465.html",
        "http://rhn.redhat.com/errata/RHSA-2016-0741.html",
        "http://www.openssh.com/txt/release-7.2",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
        "http://www.securityfocus.com/bid/84427",
        "http://www.securitytracker.com/id/1034705",
        "https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1298741",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201612-18"
      ],
      "score": 9.8,
      "services": [
        "22/ssh"
      ],
      "severity": "critical",
      "summary": "The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-287"
    },
    "CVE-2016-20012": {
      "id": "CVE-2016-20012",
      "references": [
        "https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265",
        "https://github.com/openssh/openssh-portable/pull/270",
        "https://github.com/openssh/openssh-portable/pull/270#issuecomment-920577097",
        "https://github.com/openssh/openssh-portable/pull/270#issuecomment-943909185",
        "https://rushter.com/blog/public-ssh-keys/",
        "https://security.netapp.com/advisory/ntap-20211014-0005/",
        "https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeak",
        "https://www.openwall.com/lists/oss-security/2018/08/24/1",
        "https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265",
        "https://github.com/openssh/openssh-portable/pull/270",
        "https://github.com/openssh/openssh-portable/pull/270#issuecomment-920577097",
        "https://github.com/openssh/openssh-portable/pull/270#issuecomment-943909185",
        "https://rushter.com/blog/public-ssh-keys/",
        "https://security.netapp.com/advisory/ntap-20211014-0005/",
        "https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeak",
        "https://www.openwall.com/lists/oss-security/2018/08/24/1"
      ],
      "score": 5.3,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2016-4975": {
      "id": "CVE-2016-4975",
      "references": [
        "http://www.securityfocus.com/bid/105093",
        "https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180926-0006/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "score": 6.1,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "weakness": "CWE-93"
    },
    "CVE-2016-5387": {
      "id": "CVE-2016-5387",
      "references": [
        "http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1624.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1625.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1648.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1649.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1650.html",
        "http://www.debian.org/security/2016/dsa-3623",
        "http://www.kb.cert.org/vuls/id/797896",
        "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
        "http://www.securityfocus.com/bid/91816",
        "http://www.securitytracker.com/id/1036330",
        "http://www.ubuntu.com/usn/USN-3038-1",
        "https://access.redhat.com/errata/RHSA-2016:1420",
        "https://access.redhat.com/errata/RHSA-2016:1421",
        "https://access.redhat.com/errata/RHSA-2016:1422",
        "https://access.redhat.com/errata/RHSA-2016:1635",
        "https://access.redhat.com/errata/RHSA-2016:1636",
        "https://access.redhat.com/errata/RHSA-2016:1851",
        "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
        "https://httpoxy.org/",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/",
        "https://security.gentoo.org/glsa/201701-36",
        "https://support.apple.com/HT208221",
        "https://www.apache.org/security/asf-httpoxy-response.txt",
        "https://www.tenable.com/security/tns-2017-04",
        "http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1624.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1625.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1648.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1649.html",
        "http://rhn.redhat.com/errata/RHSA-2016-1650.html",
        "http://www.debian.org/security/2016/dsa-3623",
        "http://www.kb.cert.org/vuls/id/797896",
        "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
        "http://www.securityfocus.com/bid/91816",
        "http://www.securitytracker.com/id/1036330",
        "http://www.ubuntu.com/usn/USN-3038-1",
        "https://access.redhat.com/errata/RHSA-2016:1420",
        "https://access.redhat.com/errata/RHSA-2016:1421",
        "https://access.redhat.com/errata/RHSA-2016:1422",
        "https://access.redhat.com/errata/RHSA-2016:1635",
        "https://access.redhat.com/errata/RHSA-2016:1636",
        "https://access.redhat.com/errata/RHSA-2016:1851",
        "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
        "https://httpoxy.org/",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/",
        "https://security.gentoo.org/glsa/201701-36",
        "https://support.apple.com/HT208221",
        "https://www.apache.org/security/asf-httpoxy-response.txt",
        "https://www.tenable.com/security/tns-2017-04"
      ],
      "score": 8.1,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.  NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2016-8612": {
      "id": "CVE-2016-8612",
      "references": [
        "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
        "http://www.securityfocus.com/bid/94939",
        "https://access.redhat.com/errata/RHSA-2017:0193",
        "https://access.redhat.com/errata/RHSA-2017:0194",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1387605",
        "https://security.netapp.com/advisory/ntap-20180601-0005/",
        "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
        "http://www.securityfocus.com/bid/94939",
        "https://access.redhat.com/errata/RHSA-2017:0193",
        "https://access.redhat.com/errata/RHSA-2017:0194",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1387605",
        "https://security.netapp.com/advisory/ntap-20180601-0005/"
      ],
      "score": 4.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.",
      "vector_string": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "weakness": "CWE-20"
    },
    "CVE-2016-8743": {
      "id": "CVE-2016-8743",
      "references": [
        "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
        "http://www.debian.org/security/2017/dsa-3796",
        "http://www.securityfocus.com/bid/95077",
        "http://www.securitytracker.com/id/1037508",
        "https://access.redhat.com/errata/RHSA-2017:0906",
        "https://access.redhat.com/errata/RHSA-2017:1161",
        "https://access.redhat.com/errata/RHSA-2017:1413",
        "https://access.redhat.com/errata/RHSA-2017:1414",
        "https://access.redhat.com/errata/RHSA-2017:1721",
        "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_us",
        "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-8743",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201701-36",
        "https://security.netapp.com/advisory/ntap-20180423-0001/",
        "https://support.apple.com/HT208221",
        "https://www.tenable.com/security/tns-2017-04",
        "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
        "http://www.debian.org/security/2017/dsa-3796",
        "http://www.securityfocus.com/bid/95077",
        "http://www.securitytracker.com/id/1037508",
        "https://access.redhat.com/errata/RHSA-2017:0906",
        "https://access.redhat.com/errata/RHSA-2017:1161",
        "https://access.redhat.com/errata/RHSA-2017:1413",
        "https://access.redhat.com/errata/RHSA-2017:1414",
        "https://access.redhat.com/errata/RHSA-2017:1721",
        "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_us",
        "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-8743",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201701-36",
        "https://security.netapp.com/advisory/ntap-20180423-0001/",
        "https://support.apple.com/HT208221",
        "https://www.tenable.com/security/tns-2017-04"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2017-15906": {
      "id": "CVE-2017-15906",
      "references": [
        "http://www.securityfocus.com/bid/101552",
        "https://access.redhat.com/errata/RHSA-2018:0980",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201801-05",
        "https://security.netapp.com/advisory/ntap-20180423-0004/",
        "https://www.openssh.com/txt/release-7.6",
        "https://www.oracle.com/security-alerts/cpujan2020.html",
        "http://www.securityfocus.com/bid/101552",
        "https://access.redhat.com/errata/RHSA-2018:0980",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201801-05",
        "https://security.netapp.com/advisory/ntap-20180423-0004/",
        "https://www.openssh.com/txt/release-7.6",
        "https://www.oracle.com/security-alerts/cpujan2020.html"
      ],
      "score": 5.3,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "weakness": "CWE-732"
    },
    "CVE-2017-3167": {
      "id": "CVE-2017-3167",
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99135",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4%40%3Cdev.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185",
        "https://www.tenable.com/security/tns-2019-09",
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99135",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4%40%3Cdev.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-287"
    },
    "CVE-2017-3169": {
      "id": "CVE-2017-3169",
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99134",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae%40%3Cdev.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-476"
    },
    "CVE-2017-7679": {
      "id": "CVE-2017-7679",
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99170",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751%40%3Cdev.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185",
        "https://www.tenable.com/security/tns-2019-09",
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99170",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751%40%3Cdev.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-126"
    },
    "CVE-2017-9788": {
      "id": "CVE-2017-9788",
      "references": [
        "http://www.debian.org/security/2017/dsa-3913",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99569",
        "http://www.securitytracker.com/id/1038906",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:2708",
        "https://access.redhat.com/errata/RHSA-2017:2709",
        "https://access.redhat.com/errata/RHSA-2017:2710",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://httpd.apache.org/security/vulnerabilities_22.html",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb%40%3Cannounce.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20170911-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.tenable.com/security/tns-2019-09",
        "http://www.debian.org/security/2017/dsa-3913",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99569",
        "http://www.securitytracker.com/id/1038906",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:2708",
        "https://access.redhat.com/errata/RHSA-2017:2709",
        "https://access.redhat.com/errata/RHSA-2017:2710",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://httpd.apache.org/security/vulnerabilities_22.html",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb%40%3Cannounce.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20170911-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 9.1,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "weakness": "CWE-20"
    },
    "CVE-2017-9798": {
      "id": "CVE-2017-9798",
      "references": [
        "http://openwall.com/lists/oss-security/2017/09/18/2",
        "http://www.debian.org/security/2017/dsa-3980",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
        "http://www.securityfocus.com/bid/100872",
        "http://www.securityfocus.com/bid/105598",
        "http://www.securitytracker.com/id/1039387",
        "https://access.redhat.com/errata/RHSA-2017:2882",
        "https://access.redhat.com/errata/RHSA-2017:2972",
        "https://access.redhat.com/errata/RHSA-2017:3018",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
        "https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
        "https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a",
        "https://github.com/hannob/optionsbleed",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security-tracker.debian.org/tracker/CVE-2017-9798",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0003/",
        "https://support.apple.com/HT208331",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
        "https://www.exploit-db.com/exploits/42745/",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
        "https://www.tenable.com/security/tns-2019-09",
        "http://openwall.com/lists/oss-security/2017/09/18/2",
        "http://seclists.org/fulldisclosure/2024/Sep/22",
        "http://www.debian.org/security/2017/dsa-3980",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
        "http://www.securityfocus.com/bid/100872",
        "http://www.securityfocus.com/bid/105598",
        "http://www.securitytracker.com/id/1039387",
        "https://access.redhat.com/errata/RHSA-2017:2882",
        "https://access.redhat.com/errata/RHSA-2017:2972",
        "https://access.redhat.com/errata/RHSA-2017:3018",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
        "https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
        "https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a",
        "https://github.com/hannob/optionsbleed",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security-tracker.debian.org/tracker/CVE-2017-9798",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0003/",
        "https://support.apple.com/HT208331",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
        "https://www.exploit-db.com/exploits/42745/",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "weakness": "CWE-416"
    },
    "CVE-2018-1301": {
      "id": "CVE-2018-1301",
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/2",
        "http://www.securityfocus.com/bid/103515",
        "http://www.securitytracker.com/id/1040573",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://usn.ubuntu.com/3937-2/",
        "https://www.debian.org/security/2018/dsa-4164",
        "https://www.tenable.com/security/tns-2019-09",
        "http://www.openwall.com/lists/oss-security/2018/03/24/2",
        "http://www.securityfocus.com/bid/103515",
        "http://www.securitytracker.com/id/1040573",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://usn.ubuntu.com/3937-2/",
        "https://www.debian.org/security/2018/dsa-4164",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 5.9,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.",
      "vector_string": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-119"
    },
    "CVE-2018-1302": {
      "id": "CVE-2018-1302",
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/5",
        "http://www.securityfocus.com/bid/103528",
        "http://www.securitytracker.com/id/1040567",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3783-1/",
        "https://www.tenable.com/security/tns-2019-09",
        "http://www.openwall.com/lists/oss-security/2018/03/24/5",
        "http://www.securityfocus.com/bid/103528",
        "http://www.securitytracker.com/id/1040567",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3783-1/",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 5.9,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.",
      "vector_string": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-476"
    },
    "CVE-2018-1303": {
      "id": "CVE-2018-1303",
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/3",
        "http://www.securityfocus.com/bid/103522",
        "http://www.securitytracker.com/id/1040572",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://www.debian.org/security/2018/dsa-4164",
        "https://www.tenable.com/security/tns-2019-09",
        "http://www.openwall.com/lists/oss-security/2018/03/24/3",
        "http://www.securityfocus.com/bid/103522",
        "http://www.securitytracker.com/id/1040572",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://www.debian.org/security/2018/dsa-4164",
        "https://www.tenable.com/security/tns-2019-09"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.",
      "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-125"
    },
    "CVE-2018-15473": {
      "id": "CVE-2018-15473",
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/08/15/5",
        "http://www.securityfocus.com/bid/105140",
        "http://www.securitytracker.com/id/1041487",
        "https://access.redhat.com/errata/RHSA-2019:0711",
        "https://access.redhat.com/errata/RHSA-2019:2143",
        "https://bugs.debian.org/906236",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0",
        "https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html",
        "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011",
        "https://security.gentoo.org/glsa/201810-03",
        "https://security.netapp.com/advisory/ntap-20181101-0001/",
        "https://usn.ubuntu.com/3809-1/",
        "https://www.debian.org/security/2018/dsa-4280",
        "https://www.exploit-db.com/exploits/45210/",
        "https://www.exploit-db.com/exploits/45233/",
        "https://www.exploit-db.com/exploits/45939/",
        "https://www.oracle.com/security-alerts/cpujan2020.html",
        "http://www.openwall.com/lists/oss-security/2018/08/15/5",
        "http://www.securityfocus.com/bid/105140",
        "http://www.securitytracker.com/id/1041487",
        "https://access.redhat.com/errata/RHSA-2019:0711",
        "https://access.redhat.com/errata/RHSA-2019:2143",
        "https://bugs.debian.org/906236",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0",
        "https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html",
        "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011",
        "https://security.gentoo.org/glsa/201810-03",
        "https://security.netapp.com/advisory/ntap-20181101-0001/",
        "https://usn.ubuntu.com/3809-1/",
        "https://www.debian.org/security/2018/dsa-4280",
        "https://www.exploit-db.com/exploits/45210/",
        "https://www.exploit-db.com/exploits/45233/",
        "https://www.exploit-db.com/exploits/45939/",
        "https://www.oracle.com/security-alerts/cpujan2020.html"
      ],
      "score": 5.3,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "weakness": "CWE-362"
    },
    "CVE-2018-20685": {
      "id": "CVE-2018-20685",
      "references": [
        "http://www.securityfocus.com/bid/106531",
        "https://access.redhat.com/errata/RHSA-2019:3702",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h",
        "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2",
        "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.gentoo.org/glsa/202007-53",
        "https://security.netapp.com/advisory/ntap-20190215-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://usn.ubuntu.com/3885-1/",
        "https://www.debian.org/security/2019/dsa-4387",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
        "http://www.securityfocus.com/bid/106531",
        "https://access.redhat.com/errata/RHSA-2019:3702",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h",
        "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2",
        "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.gentoo.org/glsa/202007-53",
        "https://security.netapp.com/advisory/ntap-20190215-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://usn.ubuntu.com/3885-1/",
        "https://www.debian.org/security/2019/dsa-4387",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      ],
      "score": 5.3,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "weakness": "CWE-863"
    },
    "CVE-2019-6109": {
      "id": "CVE-2019-6109",
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html",
        "https://access.redhat.com/errata/RHSA-2019:3702",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c",
        "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.netapp.com/advisory/ntap-20190213-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://usn.ubuntu.com/3885-1/",
        "https://www.debian.org/security/2019/dsa-4387",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html",
        "https://access.redhat.com/errata/RHSA-2019:3702",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c",
        "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.netapp.com/advisory/ntap-20190213-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://usn.ubuntu.com/3885-1/",
        "https://www.debian.org/security/2019/dsa-4387",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      ],
      "score": 6.8,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "weakness": "CWE-116"
    },
    "CVE-2019-6110": {
      "id": "CVE-2019-6110",
      "references": [
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.netapp.com/advisory/ntap-20190213-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://www.exploit-db.com/exploits/46193/",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.netapp.com/advisory/ntap-20190213-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://www.exploit-db.com/exploits/46193/"
      ],
      "score": 6.8,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "weakness": "CWE-838"
    },
    "CVE-2019-6111": {
      "id": "CVE-2019-6111",
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html",
        "http://www.openwall.com/lists/oss-security/2019/04/18/1",
        "http://www.openwall.com/lists/oss-security/2022/08/02/1",
        "http://www.securityfocus.com/bid/106741",
        "https://access.redhat.com/errata/RHSA-2019:3702",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1677794",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c",
        "https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.netapp.com/advisory/ntap-20190213-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://usn.ubuntu.com/3885-1/",
        "https://usn.ubuntu.com/3885-2/",
        "https://www.debian.org/security/2019/dsa-4387",
        "https://www.exploit-db.com/exploits/46193/",
        "https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html",
        "http://www.openwall.com/lists/oss-security/2019/04/18/1",
        "http://www.openwall.com/lists/oss-security/2022/08/02/1",
        "http://www.securityfocus.com/bid/106741",
        "https://access.redhat.com/errata/RHSA-2019:3702",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1677794",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
        "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c",
        "https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E",
        "https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/",
        "https://security.gentoo.org/glsa/201903-16",
        "https://security.netapp.com/advisory/ntap-20190213-0001/",
        "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt",
        "https://usn.ubuntu.com/3885-1/",
        "https://usn.ubuntu.com/3885-2/",
        "https://www.debian.org/security/2019/dsa-4387",
        "https://www.exploit-db.com/exploits/46193/",
        "https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc",
        "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      ],
      "score": 5.9,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "weakness": "CWE-22"
    },
    "CVE-2020-15778": {
      "id": "CVE-2020-15778",
      "references": [
        "https://access.redhat.com/errata/RHSA-2024:3166",
        "https://github.com/cpandya2909/CVE-2020-15778/",
        "https://news.ycombinator.com/item?id=25005567",
        "https://security.gentoo.org/glsa/202212-06",
        "https://security.netapp.com/advisory/ntap-20200731-0007/",
        "https://www.openssh.com/security.html",
        "https://access.redhat.com/errata/RHSA-2024:3166",
        "https://github.com/cpandya2909/CVE-2020-15778/",
        "https://news.ycombinator.com/item?id=25005567",
        "https://security.gentoo.org/glsa/202212-06",
        "https://security.netapp.com/advisory/ntap-20200731-0007/",
        "https://www.openssh.com/security.html"
      ],
      "score": 7.4,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"",
      "vector_string": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "weakness": "CWE-78"
    },
    "CVE-2021-34798": {
      "id": "CVE-2021-34798",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
        "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211008-0004/",
        "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
        "https://www.debian.org/security/2021/dsa-4982",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://www.tenable.com/security/tns-2021-17",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
        "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211008-0004/",
        "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
        "https://www.debian.org/security/2021/dsa-4982",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://www.tenable.com/security/tns-2021-17"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-476"
    },
    "CVE-2021-36368": {
      "id": "CVE-2021-36368",
      "references": [
        "https://bugzilla.mindrot.org/show_bug.cgi?id=3316",
        "https://docs.ssh-mitm.at/trivialauth.html",
        "https://github.com/openssh/openssh-portable/pull/258",
        "https://security-tracker.debian.org/tracker/CVE-2021-36368",
        "https://www.openssh.com/security.html",
        "https://bugzilla.mindrot.org/show_bug.cgi?id=3316",
        "https://docs.ssh-mitm.at/trivialauth.html",
        "https://github.com/openssh/openssh-portable/pull/258",
        "https://security-tracker.debian.org/tracker/CVE-2021-36368",
        "https://www.openssh.com/security.html"
      ],
      "score": 3.7,
      "services": [
        "22/ssh"
      ],
      "severity": "low",
      "summary": "An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is \"this is not an authentication bypass, since nothing is being bypassed.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "weakness": "CWE-287"
    },
    "CVE-2021-39275": {
      "id": "CVE-2021-39275",
      "references": [
        "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211008-0004/",
        "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
        "https://www.debian.org/security/2021/dsa-4982",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211008-0004/",
        "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
        "https://www.debian.org/security/2021/dsa-4982",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-787"
    },
    "CVE-2021-40438": {
      "id": "CVE-2021-40438",
      "references": [
        "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211008-0004/",
        "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
        "https://www.debian.org/security/2021/dsa-4982",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://www.tenable.com/security/tns-2021-17",
        "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211008-0004/",
        "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
        "https://www.debian.org/security/2021/dsa-4982",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://www.tenable.com/security/tns-2021-17",
        "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438"
      ],
      "score": 9,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "weakness": "CWE-918"
    },
    "CVE-2021-44790": {
      "id": "CVE-2021-44790",
      "references": [
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html",
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2021/12/20/4",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211224-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.debian.org/security/2022/dsa-5035",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://www.tenable.com/security/tns-2022-01",
        "https://www.tenable.com/security/tns-2022-03",
        "http://httpd.apache.org/security/vulnerabilities_24.html",
        "http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html",
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2021/12/20/4",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20211224-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.debian.org/security/2022/dsa-5035",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujan2022.html",
        "https://www.tenable.com/security/tns-2022-01",
        "https://www.tenable.com/security/tns-2022-03"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-787"
    },
    "CVE-2022-22719": {
      "id": "CVE-2022-22719",
      "references": [
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2022/03/14/4",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220321-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2022/03/14/4",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220321-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.oracle.com/security-alerts/cpuapr2022.html"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-665"
    },
    "CVE-2022-22720": {
      "id": "CVE-2022-22720",
      "references": [
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2022/03/14/3",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220321-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujul2022.html",
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2022/03/14/3",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220321-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujul2022.html"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-444"
    },
    "CVE-2022-22721": {
      "id": "CVE-2022-22721",
      "references": [
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2022/03/14/2",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220321-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujul2022.html",
        "http://seclists.org/fulldisclosure/2022/May/33",
        "http://seclists.org/fulldisclosure/2022/May/35",
        "http://seclists.org/fulldisclosure/2022/May/38",
        "http://www.openwall.com/lists/oss-security/2022/03/14/2",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220321-0001/",
        "https://support.apple.com/kb/HT213255",
        "https://support.apple.com/kb/HT213256",
        "https://support.apple.com/kb/HT213257",
        "https://www.oracle.com/security-alerts/cpuapr2022.html",
        "https://www.oracle.com/security-alerts/cpujul2022.html"
      ],
      "score": 9.1,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "weakness": "CWE-190"
    },
    "CVE-2022-28330": {
      "id": "CVE-2022-28330",
      "references": [
        "http://www.openwall.com/lists/oss-security/2022/06/08/3",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.netapp.com/advisory/ntap-20220624-0005/",
        "http://www.openwall.com/lists/oss-security/2022/06/08/3",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.netapp.com/advisory/ntap-20220624-0005/"
      ],
      "score": 5.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "weakness": "CWE-125"
    },
    "CVE-2022-28614": {
      "id": "CVE-2022-28614",
      "references": [
        "http://www.openwall.com/lists/oss-security/2022/06/08/4",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/",
        "http://www.openwall.com/lists/oss-security/2022/06/08/4",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/"
      ],
      "score": 5.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "weakness": "CWE-190"
    },
    "CVE-2022-28615": {
      "id": "CVE-2022-28615",
      "references": [
        "http://www.openwall.com/lists/oss-security/2022/06/08/9",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/",
        "http://www.openwall.com/lists/oss-security/2022/06/08/9",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/"
      ],
      "score": 9.1,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "weakness": "CWE-190"
    },
    "CVE-2022-29404": {
      "id": "CVE-2022-29404",
      "references": [
        "http://www.openwall.com/lists/oss-security/2022/06/08/5",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/",
        "http://www.openwall.com/lists/oss-security/2022/06/08/5",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-770"
    },
    "CVE-2022-30556": {
      "id": "CVE-2022-30556",
      "references": [
        "http://www.openwall.com/lists/oss-security/2022/06/08/7",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/",
        "http://www.openwall.com/lists/oss-security/2022/06/08/7",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "weakness": "CWE-200"
    },
    "CVE-2022-31813": {
      "id": "CVE-2022-31813",
      "references": [
        "http://www.openwall.com/lists/oss-security/2022/06/08/8",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/",
        "http://www.openwall.com/lists/oss-security/2022/06/08/8",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
        "https://security.gentoo.org/glsa/202208-20",
        "https://security.netapp.com/advisory/ntap-20220624-0005/"
      ],
      "score": 9.8,
      "services": [
        "80/http"
      ],
      "severity": "critical",
      "summary": "Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-348"
    },
    "CVE-2022-37436": {
      "id": "CVE-2022-37436",
      "references": [
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.gentoo.org/glsa/202309-01",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.gentoo.org/glsa/202309-01"
      ],
      "score": 5.3,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "weakness": "CWE-113"
    },
    "CVE-2023-31122": {
      "id": "CVE-2023-31122",
      "references": [
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/VZJTT5TEFNSBWVMKCLS6EZ7PI6EJYBCO/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZFDNHDH4VLFGDPY6MEZV2RO5N5FLFONW/",
        "https://security.netapp.com/advisory/ntap-20231027-0011/",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/VZJTT5TEFNSBWVMKCLS6EZ7PI6EJYBCO/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZFDNHDH4VLFGDPY6MEZV2RO5N5FLFONW/",
        "https://security.netapp.com/advisory/ntap-20231027-0011/"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-125"
    },
    "CVE-2023-38408": {
      "id": "CVE-2023-38408",
      "references": [
        "http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html",
        "http://www.openwall.com/lists/oss-security/2023/07/20/1",
        "http://www.openwall.com/lists/oss-security/2023/07/20/2",
        "http://www.openwall.com/lists/oss-security/2023/09/22/11",
        "http://www.openwall.com/lists/oss-security/2023/09/22/9",
        "https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent",
        "https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8",
        "https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d",
        "https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca",
        "https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/",
        "https://news.ycombinator.com/item?id=36790196",
        "https://security.gentoo.org/glsa/202307-01",
        "https://security.netapp.com/advisory/ntap-20230803-0010/",
        "https://support.apple.com/kb/HT213940",
        "https://www.openssh.com/security.html",
        "https://www.openssh.com/txt/release-9.3p2",
        "https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt",
        "https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408",
        "http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html",
        "http://www.openwall.com/lists/oss-security/2023/07/20/1",
        "http://www.openwall.com/lists/oss-security/2023/07/20/2",
        "http://www.openwall.com/lists/oss-security/2023/09/22/11",
        "http://www.openwall.com/lists/oss-security/2023/09/22/9",
        "https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent",
        "https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8",
        "https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d",
        "https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca",
        "https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/",
        "https://news.ycombinator.com/item?id=36790196",
        "https://security.gentoo.org/glsa/202307-01",
        "https://security.netapp.com/advisory/ntap-20230803-0010/",
        "https://support.apple.com/kb/HT213940",
        "https://www.openssh.com/security.html",
        "https://www.openssh.com/txt/release-9.3p2",
        "https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt",
        "https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408"
      ],
      "score": 9.8,
      "services": [
        "22/ssh"
      ],
      "severity": "critical",
      "summary": "The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-428"
    },
    "CVE-2023-45802": {
      "id": "CVE-2023-45802",
      "references": [
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
        "https://security.netapp.com/advisory/ntap-20231027-0011/"
      ],
      "score": 5.9,
      "services": [
        "80/http"
      ],
      "severity": "medium",
      "summary": "When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.nnThis was found by the reporter during testing ofxa0CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During \"normal\" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.nnUsers are recommended to upgrade to version 2.4.58, which fixes the issue.n",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "weakness": "CWE-770"
    },
    "CVE-2023-48795": {
      "id": "CVE-2023-48795",
      "references": [
        "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html",
        "http://seclists.org/fulldisclosure/2024/Mar/21",
        "http://www.openwall.com/lists/oss-security/2023/12/18/3",
        "http://www.openwall.com/lists/oss-security/2023/12/19/5",
        "http://www.openwall.com/lists/oss-security/2023/12/20/3",
        "http://www.openwall.com/lists/oss-security/2024/03/06/3",
        "http://www.openwall.com/lists/oss-security/2024/04/17/8",
        "https://access.redhat.com/security/cve/cve-2023-48795",
        "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/",
        "https://bugs.gentoo.org/920280",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2254210",
        "https://bugzilla.suse.com/show_bug.cgi?id=1217950",
        "https://crates.io/crates/thrussh/versions",
        "https://filezilla-project.org/versions.php",
        "https://forum.netgate.com/topic/184941/terrapin-ssh-attack",
        "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6",
        "https://github.com/NixOS/nixpkgs/pull/275249",
        "https://github.com/PowerShell/Win32-OpenSSH/issues/2189",
        "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta",
        "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0",
        "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1",
        "https://github.com/advisories/GHSA-45x7-px36-x8w8",
        "https://github.com/apache/mina-sshd/issues/445",
        "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab",
        "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22",
        "https://github.com/cyd01/KiTTY/issues/520",
        "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6",
        "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42",
        "https://github.com/erlang/otp/releases/tag/OTP-26.2.1",
        "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d",
        "https://github.com/hierynomus/sshj/issues/916",
        "https://github.com/janmojzis/tinyssh/issues/81",
        "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5",
        "https://github.com/libssh2/libssh2/pull/1291",
        "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25",
        "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3",
        "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15",
        "https://github.com/mwiede/jsch/issues/457",
        "https://github.com/mwiede/jsch/pull/461",
        "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16",
        "https://github.com/openssh/openssh-portable/commits/master",
        "https://github.com/paramiko/paramiko/issues/2337",
        "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/issues/456",
        "https://github.com/rapier1/hpn-ssh/releases",
        "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst",
        "https://github.com/ronf/asyncssh/tags",
        "https://github.com/ssh-mitm/ssh-mitm/issues/165",
        "https://github.com/warp-tech/russh/releases/tag/v0.40.2",
        "https://gitlab.com/libssh/libssh-mirror/-/tags",
        "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ",
        "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg",
        "https://help.panic.com/releasenotes/transmit5/",
        "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/",
        "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html",
        "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html",
        "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html",
        "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/",
        "https://matt.ucc.asn.au/dropbear/CHANGES",
        "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC",
        "https://news.ycombinator.com/item?id=38684904",
        "https://news.ycombinator.com/item?id=38685286",
        "https://news.ycombinator.com/item?id=38732005",
        "https://nova.app/releases/#v11.8",
        "https://oryx-embedded.com/download/#changelog",
        "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002",
        "https://roumenpetrov.info/secsh/#news20231220",
        "https://security-tracker.debian.org/tracker/CVE-2023-48795",
        "https://security-tracker.debian.org/tracker/source-package/libssh2",
        "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg",
        "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2",
        "https://security.gentoo.org/glsa/202312-16",
        "https://security.gentoo.org/glsa/202312-17",
        "https://security.netapp.com/advisory/ntap-20240105-0004/",
        "https://support.apple.com/kb/HT214084",
        "https://thorntech.com/cve-2023-48795-and-sftp-gateway/",
        "https://twitter.com/TrueSkrillor/status/1736774389725565005",
        "https://ubuntu.com/security/CVE-2023-48795",
        "https://winscp.net/eng/docs/history#6.2.2",
        "https://www.bitvise.com/ssh-client-version-history#933",
        "https://www.bitvise.com/ssh-server-version-history",
        "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html",
        "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update",
        "https://www.debian.org/security/2023/dsa-5586",
        "https://www.debian.org/security/2023/dsa-5588",
        "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc",
        "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508",
        "https://www.netsarang.com/en/xshell-update-history/",
        "https://www.openssh.com/openbsd.html",
        "https://www.openssh.com/txt/release-9.6",
        "https://www.openwall.com/lists/oss-security/2023/12/18/2",
        "https://www.openwall.com/lists/oss-security/2023/12/20/3",
        "https://www.paramiko.org/changelog.html",
        "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/",
        "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/",
        "https://www.terrapin-attack.com",
        "https://www.theregister.com/2023/12/20/terrapin_attack_ssh",
        "https://www.vandyke.com/products/securecrt/history.txt",
        "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html",
        "http://seclists.org/fulldisclosure/2024/Mar/21",
        "http://www.openwall.com/lists/oss-security/2023/12/18/3",
        "http://www.openwall.com/lists/oss-security/2023/12/19/5",
        "http://www.openwall.com/lists/oss-security/2023/12/20/3",
        "http://www.openwall.com/lists/oss-security/2024/03/06/3",
        "http://www.openwall.com/lists/oss-security/2024/04/17/8",
        "https://access.redhat.com/security/cve/cve-2023-48795",
        "https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/",
        "https://bugs.gentoo.org/920280",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2254210",
        "https://bugzilla.suse.com/show_bug.cgi?id=1217950",
        "https://crates.io/crates/thrussh/versions",
        "https://filezilla-project.org/versions.php",
        "https://forum.netgate.com/topic/184941/terrapin-ssh-attack",
        "https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6",
        "https://github.com/NixOS/nixpkgs/pull/275249",
        "https://github.com/PowerShell/Win32-OpenSSH/issues/2189",
        "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta",
        "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0",
        "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1",
        "https://github.com/advisories/GHSA-45x7-px36-x8w8",
        "https://github.com/apache/mina-sshd/issues/445",
        "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab",
        "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22",
        "https://github.com/cyd01/KiTTY/issues/520",
        "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6",
        "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42",
        "https://github.com/erlang/otp/releases/tag/OTP-26.2.1",
        "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d",
        "https://github.com/hierynomus/sshj/issues/916",
        "https://github.com/janmojzis/tinyssh/issues/81",
        "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5",
        "https://github.com/libssh2/libssh2/pull/1291",
        "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25",
        "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3",
        "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15",
        "https://github.com/mwiede/jsch/issues/457",
        "https://github.com/mwiede/jsch/pull/461",
        "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16",
        "https://github.com/openssh/openssh-portable/commits/master",
        "https://github.com/paramiko/paramiko/issues/2337",
        "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/issues/456",
        "https://github.com/rapier1/hpn-ssh/releases",
        "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst",
        "https://github.com/ronf/asyncssh/tags",
        "https://github.com/ssh-mitm/ssh-mitm/issues/165",
        "https://github.com/warp-tech/russh/releases/tag/v0.40.2",
        "https://gitlab.com/libssh/libssh-mirror/-/tags",
        "https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ",
        "https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg",
        "https://help.panic.com/releasenotes/transmit5/",
        "https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/",
        "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html",
        "https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html",
        "https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html",
        "https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html",
        "https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html",
        "https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html",
        "https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/",
        "https://lists.fedoraproject.org/archives/list/[email protected]/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/",
        "https://matt.ucc.asn.au/dropbear/CHANGES",
        "https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC",
        "https://news.ycombinator.com/item?id=38684904",
        "https://news.ycombinator.com/item?id=38685286",
        "https://news.ycombinator.com/item?id=38732005",
        "https://nova.app/releases/#v11.8",
        "https://oryx-embedded.com/download/#changelog",
        "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002",
        "https://roumenpetrov.info/secsh/#news20231220",
        "https://security-tracker.debian.org/tracker/CVE-2023-48795",
        "https://security-tracker.debian.org/tracker/source-package/libssh2",
        "https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg",
        "https://security-tracker.debian.org/tracker/source-package/trilead-ssh2",
        "https://security.gentoo.org/glsa/202312-16",
        "https://security.gentoo.org/glsa/202312-17",
        "https://security.netapp.com/advisory/ntap-20240105-0004/",
        "https://support.apple.com/kb/HT214084",
        "https://thorntech.com/cve-2023-48795-and-sftp-gateway/",
        "https://twitter.com/TrueSkrillor/status/1736774389725565005",
        "https://ubuntu.com/security/CVE-2023-48795",
        "https://winscp.net/eng/docs/history#6.2.2",
        "https://www.bitvise.com/ssh-client-version-history#933",
        "https://www.bitvise.com/ssh-server-version-history",
        "https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html",
        "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update",
        "https://www.debian.org/security/2023/dsa-5586",
        "https://www.debian.org/security/2023/dsa-5588",
        "https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc",
        "https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508",
        "https://www.netsarang.com/en/xshell-update-history/",
        "https://www.openssh.com/openbsd.html",
        "https://www.openssh.com/txt/release-9.6",
        "https://www.openwall.com/lists/oss-security/2023/12/18/2",
        "https://www.openwall.com/lists/oss-security/2023/12/20/3",
        "https://www.paramiko.org/changelog.html",
        "https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/",
        "https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/",
        "https://www.terrapin-attack.com",
        "https://www.theregister.com/2023/12/20/terrapin_attack_ssh",
        "https://www.vandyke.com/products/securecrt/history.txt",
        "https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit",
        "https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability"
      ],
      "score": 5.9,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in [email protected] and (if CBC is used) the [email protected] MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "weakness": "CWE-354"
    },
    "CVE-2023-51384": {
      "id": "CVE-2023-51384",
      "references": [
        "http://seclists.org/fulldisclosure/2024/Mar/21",
        "https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b",
        "https://security.netapp.com/advisory/ntap-20240105-0005/",
        "https://support.apple.com/kb/HT214084",
        "https://www.debian.org/security/2023/dsa-5586",
        "https://www.openssh.com/txt/release-9.6",
        "https://www.openwall.com/lists/oss-security/2023/12/18/2",
        "http://seclists.org/fulldisclosure/2024/Mar/21",
        "https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b",
        "https://security.netapp.com/advisory/ntap-20240105-0005/",
        "https://support.apple.com/kb/HT214084",
        "https://www.debian.org/security/2023/dsa-5586",
        "https://www.openssh.com/txt/release-9.6",
        "https://www.openwall.com/lists/oss-security/2023/12/18/2"
      ],
      "score": 5.5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.",
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "weakness": "NVD-CWE-noinfo"
    },
    "CVE-2023-51385": {
      "id": "CVE-2023-51385",
      "references": [
        "http://seclists.org/fulldisclosure/2024/Mar/21",
        "http://www.openwall.com/lists/oss-security/2023/12/26/4",
        "https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a",
        "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html",
        "https://security.gentoo.org/glsa/202312-17",
        "https://security.netapp.com/advisory/ntap-20240105-0005/",
        "https://support.apple.com/kb/HT214084",
        "https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html",
        "https://www.debian.org/security/2023/dsa-5586",
        "https://www.openssh.com/txt/release-9.6",
        "https://www.openwall.com/lists/oss-security/2023/12/18/2",
        "http://seclists.org/fulldisclosure/2024/Mar/21",
        "http://www.openwall.com/lists/oss-security/2023/12/26/4",
        "http://www.openwall.com/lists/oss-security/2025/10/07/1",
        "http://www.openwall.com/lists/oss-security/2025/10/12/1",
        "https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a",
        "https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html",
        "https://security.gentoo.org/glsa/202312-17",
        "https://security.netapp.com/advisory/ntap-20240105-0005/",
        "https://support.apple.com/kb/HT214084",
        "https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html",
        "https://www.debian.org/security/2023/dsa-5586",
        "https://www.openssh.com/txt/release-9.6",
        "https://www.openwall.com/lists/oss-security/2023/12/18/2"
      ],
      "score": 6.5,
      "services": [
        "22/ssh"
      ],
      "severity": "medium",
      "summary": "In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "weakness": "CWE-78"
    },
    "CVE-2023-51767": {
      "id": "CVE-2023-51767",
      "references": [
        "https://access.redhat.com/security/cve/CVE-2023-51767",
        "https://arxiv.org/abs/2309.02545",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2255850",
        "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77",
        "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878",
        "https://security.netapp.com/advisory/ntap-20240125-0006/",
        "https://ubuntu.com/security/CVE-2023-51767",
        "https://www.openwall.com/lists/oss-security/2025/09/22/1",
        "http://www.openwall.com/lists/oss-security/2025/09/22/1",
        "http://www.openwall.com/lists/oss-security/2025/09/22/2",
        "http://www.openwall.com/lists/oss-security/2025/09/23/1",
        "http://www.openwall.com/lists/oss-security/2025/09/23/3",
        "http://www.openwall.com/lists/oss-security/2025/09/23/4",
        "http://www.openwall.com/lists/oss-security/2025/09/23/5",
        "http://www.openwall.com/lists/oss-security/2025/09/24/4",
        "http://www.openwall.com/lists/oss-security/2025/09/24/7",
        "http://www.openwall.com/lists/oss-security/2025/09/25/2",
        "http://www.openwall.com/lists/oss-security/2025/09/25/6",
        "http://www.openwall.com/lists/oss-security/2025/09/26/2",
        "http://www.openwall.com/lists/oss-security/2025/09/26/4",
        "http://www.openwall.com/lists/oss-security/2025/09/27/1",
        "http://www.openwall.com/lists/oss-security/2025/09/27/2",
        "http://www.openwall.com/lists/oss-security/2025/09/27/3",
        "http://www.openwall.com/lists/oss-security/2025/09/27/4",
        "http://www.openwall.com/lists/oss-security/2025/09/27/5",
        "http://www.openwall.com/lists/oss-security/2025/09/27/6",
        "http://www.openwall.com/lists/oss-security/2025/09/27/7",
        "http://www.openwall.com/lists/oss-security/2025/09/28/7",
        "http://www.openwall.com/lists/oss-security/2025/09/29/1",
        "http://www.openwall.com/lists/oss-security/2025/09/29/4",
        "http://www.openwall.com/lists/oss-security/2025/09/29/5",
        "http://www.openwall.com/lists/oss-security/2025/09/29/6",
        "http://www.openwall.com/lists/oss-security/2025/10/01/1",
        "http://www.openwall.com/lists/oss-security/2025/10/01/2",
        "https://access.redhat.com/security/cve/CVE-2023-51767",
        "https://arxiv.org/abs/2309.02545",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2255850",
        "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77",
        "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878",
        "https://security.netapp.com/advisory/ntap-20240125-0006/",
        "https://ubuntu.com/security/CVE-2023-51767"
      ],
      "score": 7,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"",
      "vector_string": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "NVD-CWE-Other"
    },
    "CVE-2024-40898": {
      "id": "CVE-2024-40898",
      "references": [
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "http://www.openwall.com/lists/oss-security/2024/07/17/7",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.netapp.com/advisory/ntap-20240808-0006/"
      ],
      "score": 7.5,
      "services": [
        "80/http"
      ],
      "severity": "high",
      "summary": "SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.\n\nUsers are recommended to upgrade to version 2.4.62 which fixes this issue. ",
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "weakness": "CWE-918"
    },
    "CVE-2024-6387": {
      "id": "CVE-2024-6387",
      "references": [
        "https://access.redhat.com/errata/RHSA-2024:4312",
        "https://access.redhat.com/errata/RHSA-2024:4340",
        "https://access.redhat.com/errata/RHSA-2024:4389",
        "https://access.redhat.com/errata/RHSA-2024:4469",
        "https://access.redhat.com/errata/RHSA-2024:4474",
        "https://access.redhat.com/errata/RHSA-2024:4479",
        "https://access.redhat.com/errata/RHSA-2024:4484",
        "https://access.redhat.com/security/cve/CVE-2024-6387",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2294604",
        "https://santandersecurityresearch.github.io/blog/sshing_the_masses.html",
        "https://www.openssh.com/txt/release-9.8",
        "https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt",
        "http://seclists.org/fulldisclosure/2024/Jul/18",
        "http://seclists.org/fulldisclosure/2024/Jul/19",
        "http://seclists.org/fulldisclosure/2024/Jul/20",
        "http://www.openwall.com/lists/oss-security/2024/07/01/12",
        "http://www.openwall.com/lists/oss-security/2024/07/01/13",
        "http://www.openwall.com/lists/oss-security/2024/07/02/1",
        "http://www.openwall.com/lists/oss-security/2024/07/03/1",
        "http://www.openwall.com/lists/oss-security/2024/07/03/11",
        "http://www.openwall.com/lists/oss-security/2024/07/03/2",
        "http://www.openwall.com/lists/oss-security/2024/07/03/3",
        "http://www.openwall.com/lists/oss-security/2024/07/03/4",
        "http://www.openwall.com/lists/oss-security/2024/07/03/5",
        "http://www.openwall.com/lists/oss-security/2024/07/04/1",
        "http://www.openwall.com/lists/oss-security/2024/07/04/2",
        "http://www.openwall.com/lists/oss-security/2024/07/08/2",
        "http://www.openwall.com/lists/oss-security/2024/07/08/3",
        "http://www.openwall.com/lists/oss-security/2024/07/09/2",
        "http://www.openwall.com/lists/oss-security/2024/07/09/5",
        "http://www.openwall.com/lists/oss-security/2024/07/10/1",
        "http://www.openwall.com/lists/oss-security/2024/07/10/2",
        "http://www.openwall.com/lists/oss-security/2024/07/10/3",
        "http://www.openwall.com/lists/oss-security/2024/07/10/4",
        "http://www.openwall.com/lists/oss-security/2024/07/10/6",
        "http://www.openwall.com/lists/oss-security/2024/07/11/1",
        "http://www.openwall.com/lists/oss-security/2024/07/11/3",
        "http://www.openwall.com/lists/oss-security/2024/07/23/4",
        "http://www.openwall.com/lists/oss-security/2024/07/23/6",
        "http://www.openwall.com/lists/oss-security/2024/07/28/2",
        "http://www.openwall.com/lists/oss-security/2024/07/28/3",
        "https://access.redhat.com/errata/RHSA-2024:4312",
        "https://access.redhat.com/errata/RHSA-2024:4340",
        "https://access.redhat.com/errata/RHSA-2024:4389",
        "https://access.redhat.com/errata/RHSA-2024:4469",
        "https://access.redhat.com/errata/RHSA-2024:4474",
        "https://access.redhat.com/errata/RHSA-2024:4479",
        "https://access.redhat.com/errata/RHSA-2024:4484",
        "https://access.redhat.com/security/cve/CVE-2024-6387",
        "https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/",
        "https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/",
        "https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2294604",
        "https://explore.alas.aws.amazon.com/CVE-2024-6387.html",
        "https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132",
        "https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc",
        "https://github.com/AlmaLinux/updates/issues/629",
        "https://github.com/Azure/AKS/issues/4379",
        "https://github.com/PowerShell/Win32-OpenSSH/discussions/2248",
        "https://github.com/PowerShell/Win32-OpenSSH/issues/2249",
        "https://github.com/microsoft/azurelinux/issues/9555",
        "https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09",
        "https://github.com/oracle/oracle-linux/issues/149",
        "https://github.com/rapier1/hpn-ssh/issues/87",
        "https://github.com/zgzhang/cve-2024-6387-poc",
        "https://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/",
        "https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html",
        "https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html",
        "https://news.ycombinator.com/item?id=40843778",
        "https://packetstorm.news/files/id/190587/",
        "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010",
        "https://santandersecurityresearch.github.io/blog/sshing_the_masses.html",
        "https://security-tracker.debian.org/tracker/CVE-2024-6387",
        "https://security.netapp.com/advisory/ntap-20240701-0001/",
        "https://sig-security.rocky.page/issues/CVE-2024-6387/",
        "https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/",
        "https://support.apple.com/kb/HT214118",
        "https://support.apple.com/kb/HT214119",
        "https://support.apple.com/kb/HT214120",
        "https://ubuntu.com/security/CVE-2024-6387",
        "https://ubuntu.com/security/notices/USN-6859-1",
        "https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do",
        "https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100",
        "https://www.exploit-db.com/exploits/52269",
        "https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc",
        "https://www.openssh.com/txt/release-9.8",
        "https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt",
        "https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html",
        "https://www.suse.com/security/cve/CVE-2024-6387.html",
        "https://www.theregister.com/2024/07/01/regresshion_openssh/",
        "https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387"
      ],
      "score": 8.1,
      "services": [
        "22/ssh"
      ],
      "severity": "high",
      "summary": "A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.",
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "weakness": "CWE-364"
    }
  }
}