Shodan

45.60.45.219

Regular View Raw Data
Last Seen: 2024-05-21
Tags:
cdn

GeneralInformation

Hostnames floridacitygas.com
fpl.com
fplhome.com
fplmaps.com
frontierutilities.com
gexaenergy.com
gridliancewest.com
imperva.com
myeverbright.com
nexteraenergy.com
nexteraenergyresources.com
nexteraenergyservices.com
powerwizard.com
Domains floridacitygas.com fpl.com fplhome.com fplmaps.com frontierutilities.com gexaenergy.com gridliancewest.com imperva.com myeverbright.com nexteraenergy.com nexteraenergyresources.com nexteraenergyservices.com powerwizard.com 
Country United States
City Redwood City
Organization Incapsula Inc
ISP Incapsula Inc
ASN AS19551

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

CVE-2023-45802 When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVE-2023-31122 Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
CVE-2022-37436 Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
CVE-2022-31813 7.5Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
CVE-2022-30556 5.0Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
CVE-2022-29404 5.0In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
CVE-2022-28615 6.4Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.
CVE-2022-28614 5.0The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.
CVE-2022-28330 5.0Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
CVE-2022-22721 5.8If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVE-2022-22720 7.5Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
CVE-2022-22719 5.0A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVE-2021-44790 7.5A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
CVE-2021-40438 6.8A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-39275 7.5ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-34798 5.0Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-32792 4.3mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
CVE-2021-32791 4.3mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.
CVE-2021-32786 5.8mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
CVE-2021-32785 4.3mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.
CVE-2018-1303 5.0A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
CVE-2018-1302 4.3When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
CVE-2018-1301 4.3A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.
CVE-2017-9798 5.0Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
CVE-2017-9788 6.4In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
CVE-2017-7679 7.5In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
CVE-2017-3169 7.5In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
CVE-2017-3167 7.5In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
CVE-2016-8743 5.0Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
CVE-2016-8612 3.3Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
CVE-2016-5387 6.8The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
CVE-2016-4975 4.3Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
CVE-2015-3183 5.0The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
CVE-2015-0228 5.0The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
CVE-2014-0231 5.0The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
CVE-2014-0226 6.8Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
CVE-2014-0118 4.3The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
CVE-2014-0098 5.0The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
CVE-2013-6438 5.0The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
CVE-2013-5704 5.0The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
CVE-2013-4365 7.5Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.
CVE-2013-2765 5.0The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
CVE-2013-1896 4.3mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
CVE-2013-1862 5.1mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
CVE-2013-0942 4.3Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-0941 2.1EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
CVE-2012-4558 4.3Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
CVE-2012-4557 5.0The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
CVE-2012-4360 4.3Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4001 5.0The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
CVE-2012-3526 5.0The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
CVE-2012-3499 4.3Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
CVE-2012-2687 2.6Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
CVE-2012-0883 6.9envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
CVE-2012-0053 4.3protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
CVE-2012-0031 4.6scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
CVE-2011-4415 1.2The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
CVE-2011-4317 4.3The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
CVE-2011-3639 4.3The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
CVE-2011-3607 4.4Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
CVE-2011-3368 5.0The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
CVE-2011-3348 4.3The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
CVE-2011-3192 7.8The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
CVE-2011-2688 7.5SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
CVE-2011-1176 4.3The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
CVE-2011-0419 4.3Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
CVE-2010-2068 5.0mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
CVE-2010-1623 5.0Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
CVE-2010-1452 5.0The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
CVE-2009-3720 5.0The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
CVE-2009-3560 5.0The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-2299 5.0The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
CVE-2009-0796 2.6Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
CVE-2008-0455 4.3Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
CVE-2007-4723 7.5Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
CVE-2006-20001 A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.

OpenPorts 

-685491895 | 2024-05-21T01:10:55.405396
25 / tcp 
1532511643 | 2024-05-20T23:41:09.030242
43 / tcp 
-2133569764 | 2024-05-21T08:23:48.874752
80 / tcp 
282610923 | 2024-05-21T04:26:29.198708
81 / tcp 
-1418106345 | 2024-05-21T07:52:40.147218
82 / tcp 
1985225706 | 2024-05-21T04:09:55.330116
83 / tcp 
43623848 | 2024-05-21T05:15:34.958492
84 / tcp 
-939361844 | 2024-05-21T07:03:53.746500
88 / tcp 
-1391315294 | 2024-05-20T22:46:43.149764
389 / tcp 
806484921 | 2024-05-21T04:04:33.063727
443 / tcp 
1912489940 | 2024-05-21T09:29:05.198221
444 / tcp 
-565092125 | 2024-05-20T22:33:31.081651
465 / tcp 
1436636597 | 2024-05-21T01:04:02.322135
554 / tcp 
-2067547140 | 2024-05-21T06:10:56.652732
587 / tcp 
-698559018 | 2024-05-21T05:35:45.747521
631 / tcp 
258707917 | 2024-05-21T00:36:53.079833
636 / tcp 
1055781216 | 2024-05-21T08:48:13.958283
1024 / tcp 
-1272267488 | 2024-05-19T09:13:40.909201
1177 / tcp 
-1118980379 | 2024-05-21T09:15:25.789083
1234 / tcp 
-1960708752 | 2024-05-21T00:40:33.632655
1337 / tcp 
-178016827 | 2024-05-21T09:27:19.345913
1400 / tcp 
1267109544 | 2024-05-20T20:50:49.646360
1433 / tcp 
-880476090 | 2024-05-21T06:40:52.875933
1521 / tcp 
-1820214598 | 2024-05-21T09:25:21.452087
1935 / tcp 
-593493270 | 2024-05-20T20:39:44.299004
2000 / tcp 
729764282 | 2024-05-21T07:41:04.484813
2082 / tcp 
-2087307490 | 2024-05-20T12:02:20.297947
2083 / tcp 
1837854023 | 2024-05-21T05:33:03.728197
2086 / tcp 
604918715 | 2024-05-21T09:35:38.169613
2087 / tcp 
-1931722592 | 2024-05-20T22:18:04.059828
2222 / tcp 
-618129996 | 2024-05-20T22:52:26.144869
2345 / tcp 
-1683552517 | 2024-05-21T03:41:20.986904
2375 / tcp 
2030109658 | 2024-05-20T21:17:32.814734
2376 / tcp 
108803912 | 2024-05-21T07:41:42.738239
2404 / tcp 
-1594449865 | 2024-05-21T07:09:16.590622
2480 / tcp 
-160513090 | 2024-05-20T23:47:30.390523
2628 / tcp 
-1836682824 | 2024-05-20T23:53:17.402198
2761 / tcp 
683030647 | 2024-05-20T21:57:25.453472
2762 / tcp 
620632661 | 2024-05-20T21:48:17.656715
3000 / tcp 
-1516683312 | 2024-05-21T07:42:40.661052
3001 / tcp 
-749802506 | 2024-05-21T08:05:19.591098
3050 / tcp 
311439038 | 2024-05-21T02:08:50.313553
3268 / tcp 
1335141892 | 2024-05-21T02:06:00.135107
3269 / tcp 
-1509995427 | 2024-05-20T21:44:25.240016
3299 / tcp 
-637048372 | 2024-05-02T13:57:13.618592
3333 / tcp 
-469199601 | 2024-05-21T05:37:45.305650
3389 / tcp 
-1852143847 | 2024-05-21T08:15:44.840421
3790 / tcp 
668349921 | 2024-05-21T06:23:07.380985
4000 / tcp 
217821006 | 2024-05-21T08:55:02.314436
4022 / tcp 
-1212867351 | 2024-05-21T01:22:54.790379
4040 / tcp 
0 | 2024-05-21T07:26:45.326960
4064 / tcp 
577481156 | 2024-05-21T05:52:53.892433
4443 / tcp 
-1633089863 | 2024-05-20T21:04:19.677092
4444 / tcp 
-336054183 | 2024-05-16T10:14:14.232963
4451 / tcp 
2124358383 | 2024-05-21T01:26:55.067786
4500 / tcp 
-1250454597 | 2024-05-21T02:40:50.379820
4567 / tcp 
2094156572 | 2024-05-20T23:11:48.757548
4848 / tcp 
-1537706652 | 2024-05-21T08:33:08.052320
4911 / tcp 
37482412 | 2024-05-21T08:13:56.372271
5000 / tcp 
1456657525 | 2024-05-21T07:02:46.292166
5001 / tcp 
-226804917 | 2024-05-21T09:08:36.695492
5005 / tcp 
-2065466718 | 2024-05-21T04:13:13.930589
5006 / tcp 
184753515 | 2024-05-21T05:26:43.033876
5007 / tcp 
-399232966 | 2024-05-21T07:14:43.728998
5009 / tcp 
-40258709 | 2024-05-20T23:37:59.582141
5010 / tcp 
-1104895471 | 2024-05-20T23:03:29.132187
5201 / tcp 
-1139850444 | 2024-05-21T02:17:01.697493
5222 / tcp 
1556777576 | 2024-05-21T01:48:24.451173
5555 / tcp 
2027630471 | 2024-05-21T01:54:54.230821
5560 / tcp 
1594275935 | 2024-05-21T08:52:39.817995
5601 / tcp 
756305903 | 2024-05-21T07:40:52.520694
5672 / tcp 
1034278301 | 2024-05-21T06:49:13.052127
5900 / tcp 
633983506 | 2024-05-20T23:13:10.334289
5985 / tcp 
-1136567201 | 2024-05-21T08:29:41.420700
5986 / tcp 
-1203596567 | 2024-05-20T21:01:47.311109
6000 / tcp 
1688192376 | 2024-05-21T03:52:46.224829
6001 / tcp 
-1184092149 | 2024-05-21T07:43:01.431271
6080 / tcp 
-30757832 | 2024-05-21T04:07:42.386367
6443 / tcp 
-1347565004 | 2024-05-21T05:11:59.501513
7001 / tcp 
151504620 | 2024-05-20T23:54:38.108604
7071 / tcp 
1013070128 | 2024-05-21T05:08:24.101045
7171 / tcp 
710030136 | 2024-05-21T02:03:52.028751
7443 / tcp 
-1959215849 | 2024-05-21T08:51:32.009203
7474 / tcp 
-2063190886 | 2024-05-21T01:10:53.031734
7547 / tcp 
1076226159 | 2024-05-21T04:53:04.110521
7548 / tcp 
153575024 | 2024-05-21T08:56:18.357186
7777 / tcp 
1487886251 | 2024-05-21T08:26:39.587583
7779 / tcp 
-420592525 | 2024-05-20T21:07:40.662287
8000 / tcp 
-1806641298 | 2024-05-21T00:49:48.035081
8001 / tcp 
-889322442 | 2024-05-21T06:11:48.443769
8008 / tcp 
679254132 | 2024-05-21T05:19:48.429673
8009 / tcp 
1566773809 | 2024-05-20T23:47:21.563878
8010 / tcp 
-167011594 | 2024-05-21T08:37:36.165310
8060 / tcp 
1014730714 | 2024-05-21T09:05:58.677159
8069 / tcp 
12130497 | 2024-05-21T07:20:25.422082
8080 / tcp 
1322344181 | 2024-05-21T06:08:27.045311
8081 / tcp 
-638727532 | 2024-05-02T21:04:17.245705
8082 / tcp 
232238587 | 2024-05-21T09:21:45.216272
8083 / tcp 
-696869801 | 2024-05-19T05:41:04.181355
8085 / tcp 
1839296219 | 2024-05-21T07:27:08.668594
8086 / tcp 
-1900204100 | 2024-05-21T04:19:17.665382
8089 / tcp 
-179519837 | 2024-05-21T07:16:03.245631
8090 / tcp 
956599338 | 2024-05-21T07:28:35.974163
8098 / tcp 
273856603 | 2024-05-21T08:41:22.321324
8112 / tcp 
-1670789840 | 2024-05-21T04:30:13.285350
8123 / tcp 
1207652728 | 2024-05-21T08:39:50.043416
8126 / tcp 
1904107436 | 2024-05-20T14:57:45.939171
8139 / tcp 
1797828333 | 2024-05-21T09:04:51.013388
8140 / tcp 
-479849752 | 2024-05-21T07:10:42.817226
8181 / tcp 
1505931869 | 2024-05-20T22:23:21.551065
8200 / tcp 
-1557699781 | 2024-05-21T05:35:34.050148
8443 / tcp 
-1600378760 | 2024-05-20T22:55:36.348279
8800 / tcp 
343056214 | 2024-05-21T01:30:38.111567
8834 / tcp 
978514127 | 2024-05-21T04:42:42.598067
8880 / tcp 
1274683443 | 2024-05-21T06:22:17.789990
8888 / tcp 
259517743 | 2024-05-20T22:50:03.498372
8889 / tcp 
1732908828 | 2024-05-21T07:02:40.496749
9000 / tcp 
-165500526 | 2024-05-21T01:36:34.344587
9001 / tcp 
609232953 | 2024-05-20T20:58:22.828271
9002 / tcp 
421966751 | 2024-05-21T06:21:17.212051
9009 / tcp 
637891359 | 2024-05-20T22:12:27.566043
9080 / tcp 
-1838173822 | 2024-05-21T00:02:42.665454
9090 / tcp 
1687512498 | 2024-05-21T07:07:33.864327
9091 / tcp 
-1051483593 | 2024-05-06T02:37:14.563748
9095 / tcp 
-433350647 | 2024-05-21T05:52:45.775434
9100 / tcp 
2018673342 | 2024-05-21T04:04:53.752823
9200 / tcp 
917979167 | 2024-05-21T00:09:39.291536
9306 / tcp 
245132752 | 2024-05-21T03:03:51.479318
9443 / tcp 
792215503 | 2024-05-20T23:15:35.517079
9600 / tcp 
-324748075 | 2024-05-17T19:45:38.948132
9876 / tcp 
1449957350 | 2024-05-20T21:40:02.078053
9943 / tcp 
2124789599 | 2024-05-21T07:21:07.286232
9998 / tcp 
-932633739 | 2024-05-21T04:50:04.265822
9999 / tcp 
282338333 | 2024-05-21T02:20:17.285631
10000 / tcp 
-1959319267 | 2024-05-21T07:31:17.402431
10001 / tcp 
-2067028711 | 2024-05-19T11:06:33.891187
10134 / tcp 
346295729 | 2024-05-21T01:33:59.926255
10443 / tcp 
291699673 | 2024-05-15T17:08:49.299703
12345 / tcp 
-899507970 | 2024-05-20T23:24:24.708531
13579 / tcp 
-54081746 | 2024-05-20T21:08:00.604537
14265 / tcp 
1771920610 | 2024-05-05T08:57:27.078093
16010 / tcp 
-992335602 | 2024-05-11T00:35:57.443411
16030 / tcp 
1494004153 | 2024-05-21T06:19:23.766894
20000 / tcp 
828821833 | 2024-05-02T00:12:43.031683
28080 / tcp 
-144767162 | 2024-05-20T22:54:45.177212
31337 / tcp 
-1917544703 | 2024-05-21T04:18:23.727659
50000 / tcp 
-89066406 | 2024-05-20T22:31:42.984356
55000 / tcp 
1520320665 | 2024-05-21T00:33:01.358755
55443 / tcp 
1476364308 | 2024-05-20T23:21:10.744575
60001 / tcp



Products
Pricing
Contact Us

Shodan ® - All rights reserved