7.5 - HPSBUX02401 SSRT090005

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of Arbitrary Code, Cross-Site Request Forgery (CSRF)

Informations
Name	HPSBUX02401 SSRT090005	First vendor Publication	2009-02-02
Vendor	HP	Last vendor Modification	2009-02-25
Severity (Vendor)	N/A	Revision	3

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Potential security vulnerabilities have been identified with HP-UX running Apache-based Web Server or Tomcat-based Servelet Engine. The vulnerabilities could be exploited remotely to cause a Denial of Service (DoS), cross-site scripting (XSS), execution of arbitrary code, or cross-site request forgery (CSRF). Apache-based Web Server and Tomcat-based Servelet Engine are contained in the Apache Web Server Suite.

Original Source

Url : http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01650939

CWE : Common Weakness Enumeration

%	Id	Name
38 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
25 %	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)
12 %	CWE-770	Allocation of Resources Without Limits or Throttling
12 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
12 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10577

Oval ID:	oval:org.mitre.oval:def:10577
Title:	Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Description:	Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2370	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1

Definition Id: oval:org.mitre.oval:def:10587

Oval ID:	oval:org.mitre.oval:def:10587
Title:	Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Description:	Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2938	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1

Definition Id: oval:org.mitre.oval:def:11181

Oval ID:	oval:org.mitre.oval:def:11181
Title:	Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Description:	Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-1232	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1

Definition Id: oval:org.mitre.oval:def:11316

Oval ID:	oval:org.mitre.oval:def:11316
Title:	Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Description:	Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2939	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section httpd-devel is earlier than 0:2.0.46-71.ent AND mod_ssl is earlier than 0:2.0.46-71.ent AND httpd is earlier than 0:2.0.46-71.ent OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section httpd-suexec is earlier than 0:2.0.52-41.ent.2 AND httpd-manual is earlier than 0:2.0.52-41.ent.2 AND httpd-devel is earlier than 0:2.0.52-41.ent.2 AND mod_ssl is earlier than 0:2.0.52-41.ent.2 AND httpd is earlier than 0:2.0.52-41.ent.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section httpd-manual is earlier than 0:2.2.3-11.el5_2.4 AND httpd-devel is earlier than 0:2.2.3-11.el5_2.4 AND mod_ssl is earlier than 0:2.2.3-11.el5_2.4 AND httpd is earlier than 0:2.2.3-11.el5_2.4

Definition Id: oval:org.mitre.oval:def:11534

Oval ID:	oval:org.mitre.oval:def:11534
Title:	Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Description:	Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-1947	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1

Definition Id: oval:org.mitre.oval:def:11713

Oval ID:	oval:org.mitre.oval:def:11713
Title:	Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
Description:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-2364	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Apache
Definition Synopsis:
IF Apache HTTP Server 2.0.x is installed on the system AND The version of libhttpd.dll is less than 2.0.64 OR Apache HTTP Server 2.2.x is installed on the system AND The version of libhttpd.dll is less than 2.2.9

Definition Id: oval:org.mitre.oval:def:13835

Oval ID:	oval:org.mitre.oval:def:13835
Title:	USN-731-1 -- apache2 vulnerabilities
Description:	It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that Apache was vulnerable to a cross-site request forgery in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output
Family:	unix	Class:	patch
Reference(s):	USN-731-1 CVE-2007-6203 CVE-2007-6420 CVE-2008-1678 CVE-2008-2168 CVE-2008-2364 CVE-2008-2939	Version:	5
Platform(s):	Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06	Product(s):	apache2
Definition Synopsis:
Release section Ubuntu 7.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section apache2-mpm-perchild DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-doc DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-src DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2 DPKG is earlier than 2.2.4-3ubuntu0.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section apache2-utils DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-mpm-worker DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2.2-common DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-mpm-prefork DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-threaded-dev DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-mpm-event DPKG is earlier than 2.2.4-3ubuntu0.2 AND apache2-prefork-dev DPKG is earlier than 2.2.4-3ubuntu0.2 OR Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section apache2-mpm-perchild DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-doc DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-src DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2 DPKG is earlier than 2.2.8-1ubuntu0.4 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section apache2-utils DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-mpm-worker DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2.2-common DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-mpm-prefork DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-threaded-dev DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-mpm-event DPKG is earlier than 2.2.8-1ubuntu0.4 AND apache2-prefork-dev DPKG is earlier than 2.2.8-1ubuntu0.4 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND apache2-doc DPKG is earlier than 2.0.55-4ubuntu2.4 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section libapr0 DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-utils DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-mpm-worker DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-mpm-perchild DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-common DPKG is earlier than 2.0.55-4ubuntu2.4 AND libapr0-dev DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2 DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-threaded-dev DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-mpm-prefork DPKG is earlier than 2.0.55-4ubuntu2.4 AND apache2-prefork-dev DPKG is earlier than 2.0.55-4ubuntu2.4

Definition Id: oval:org.mitre.oval:def:19964

Oval ID:	oval:org.mitre.oval:def:19964
Title:	DSA-1593-1 tomcat5.5
Description:	It was discovered that the Host Manager web application performed insufficient input sanitising, which could lead to cross-site scripting.
Family:	unix	Class:	patch
Reference(s):	DSA-1593-1 CVE-2008-1947	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	tomcat5.5
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND tomcat5.5 DPKG is earlier than 0:5.5.20-2etch3

Definition Id: oval:org.mitre.oval:def:21729

Oval ID:	oval:org.mitre.oval:def:21729
Title:	ELSA-2008:0648: tomcat security update (Important)
Description:	Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Family:	unix	Class:	patch
Reference(s):	ELSA-2008:0648-01 CVE-2008-1232 CVE-2008-1947 CVE-2008-2370 CVE-2008-2938	Version:	21
Platform(s):	Oracle Linux 5	Product(s):	tomcat5
Definition Synopsis:
Oracle Linux 5.x rpm test tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1

Definition Id: oval:org.mitre.oval:def:21751

Oval ID:	oval:org.mitre.oval:def:21751
Title:	ELSA-2008:0967: httpd security and bug fix update (Moderate)
Description:	Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Family:	unix	Class:	patch
Reference(s):	ELSA-2008:0967-01 CVE-2008-2364 CVE-2008-2939	Version:	13
Platform(s):	Oracle Linux 5	Product(s):	httpd
Definition Synopsis:
Oracle Linux 5.x rpm test httpd-manual is earlier than 0:2.2.3-11.el5_2.4 AND httpd-devel is earlier than 0:2.2.3-11.el5_2.4 AND mod_ssl is earlier than 0:2.2.3-11.el5_2.4 AND httpd is earlier than 0:2.2.3-11.el5_2.4

Definition Id: oval:org.mitre.oval:def:28407

Oval ID:	oval:org.mitre.oval:def:28407
Title:	RHSA-2008:0648 -- tomcat security update (Important)
Description:	Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendErrormethod. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232)
Family:	unix	Class:	patch
Reference(s):	RHSA-2008:0648 CESA-2008:0648-CentOS 5 CVE-2008-1232 CVE-2008-1947 CVE-2008-2370 CVE-2008-2938	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	tomcat5
Definition Synopsis:
Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1 AND tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1

Definition Id: oval:org.mitre.oval:def:29289

Oval ID:	oval:org.mitre.oval:def:29289
Title:	RHSA-2008:0967 -- httpd security and bug fix update (Moderate)
Description:	Updated httpd packages that resolve several security issues and fix a bug are now available for Red Hat Enterprise Linux 3, 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the mod_proxy Apache module. An attacker in control of a Web server to which requests were being proxied could have caused a limited denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)
Family:	unix	Class:	patch
Reference(s):	RHSA-2008:0967 CESA-2008:0967-CentOS 5 CESA-2008:0967-CentOS 3 CVE-2008-2364 CVE-2008-2939	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 5 CentOS Linux 3	Product(s):	httpd
Definition Synopsis:
Red Hat Enterprise Linux 5 release section The operating system installed on the system is Red Hat Enterprise Linux 5 Packages match section httpd-devel is earlier than 0:2.2.3-11.el5_2.4 AND httpd-manual is earlier than 0:2.2.3-11.el5_2.4 AND httpd is earlier than 0:2.2.3-11.el5_2.4 AND mod_ssl is earlier than 0:2.2.3-11.el5_2.4 AND Red Hat Enterprise Linux 3 release section The operating system installed on the system is Red Hat Enterprise Linux 3 Packages match section httpd is earlier than 0:2.0.46-71.ent AND httpd-devel is earlier than 0:2.0.46-71.ent AND mod_ssl is earlier than 0:2.0.46-71.ent AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section httpd is earlier than 0:2.0.52-41.ent.2 AND httpd-devel is earlier than 0:2.0.52-41.ent.2 AND httpd-manual is earlier than 0:2.0.52-41.ent.2 AND httpd-suexec is earlier than 0:2.0.52-41.ent.2 AND mod_ssl is earlier than 0:2.0.52-41.ent.2 AND CentOS Linux 5 release section The operating system installed on the system is CentOS Linux 5.x Packages match section httpd is earlier than 0:2.2.3-11.el5.centos.4 AND httpd-devel is earlier than 0:2.2.3-11.el5.centos.4 AND httpd-manual is earlier than 0:2.2.3-11.el5.centos.4 AND mod_ssl is earlier than 0:2.2.3-11.el5.centos.4

Definition Id: oval:org.mitre.oval:def:5876

Oval ID:	oval:org.mitre.oval:def:5876
Title:	Security vulnerability in the RequestDispatcher class in Tomcat 5.5 bundled with Solaris 9 and Solaris 10 may lead to Directory Traversal.
Description:	Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2370	Version:	1
Platform(s):	Sun Solaris 9 Sun Solaris 10	Product(s):
Definition Synopsis:
IF Solaris 9 (SPARC) meets Sun Alert 251986 Solaris 9 (SPARC) is installed AND NOT Patch 114016-03 or later installed OR Solaris 10 (SPARC) meets Sun Alert 251986 Solaris 10 (SPARC) is installed AND NOT Patch 122911-15 or later installed OR Solaris 9 (x86) meets Sun Alert 251986 Solaris 9 (x86) is installed AND NOT Patch 114017-03 or later installed OR Solaris 10 (x86) meets Sun Alert 251986 Solaris 10 (x86) is installed AND NOT Patch 122912-15 or later installed AND SUNWtcatr is installed

Definition Id: oval:org.mitre.oval:def:5985

Oval ID:	oval:org.mitre.oval:def:5985
Title:	Security vulnerability in the HttpServletResponse.sendError method in Tomcat 5.5 bundled with Solaris 9 and Solaris 10 may lead to Cross Site Scripting (XSS).
Description:	Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-1232	Version:	1
Platform(s):	Sun Solaris 9 Sun Solaris 10	Product(s):
Definition Synopsis:
IF Solaris 9 (SPARC) meets Sun Alert 251986 Solaris 9 (SPARC) is installed AND NOT Patch 114016-03 or later installed OR Solaris 10 (SPARC) meets Sun Alert 251986 Solaris 10 (SPARC) is installed AND NOT Patch 122911-15 or later installed OR Solaris 9 (x86) meets Sun Alert 251986 Solaris 9 (x86) is installed AND NOT Patch 114017-03 or later installed OR Solaris 10 (x86) meets Sun Alert 251986 Solaris 10 (x86) is installed AND NOT Patch 122912-15 or later installed AND SUNWtcatr is installed

Definition Id: oval:org.mitre.oval:def:6009

Oval ID:	oval:org.mitre.oval:def:6009
Title:	Security vulnerability in the Virtual Host Manager in Tomcat 5.5 bundled with Solaris 9 and Solaris 10 may lead to Cross Site Scripting (XSS).
Description:	Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-1947	Version:	1
Platform(s):	Sun Solaris 9 Sun Solaris 10	Product(s):
Definition Synopsis:
IF Solaris 9 (SPARC) meets Sun Alert 251986 Solaris 9 (SPARC) is installed AND NOT Patch 114016-03 or later installed OR Solaris 10 (SPARC) meets Sun Alert 251986 Solaris 10 (SPARC) is installed AND NOT Patch 122911-15 or later installed OR Solaris 9 (x86) meets Sun Alert 251986 Solaris 9 (x86) is installed AND NOT Patch 114017-03 or later installed OR Solaris 10 (x86) meets Sun Alert 251986 Solaris 10 (x86) is installed AND NOT Patch 122912-15 or later installed AND SUNWtcatr is installed

Definition Id: oval:org.mitre.oval:def:6084

Oval ID:	oval:org.mitre.oval:def:6084
Title:	HP-UX Running Apache, Remote Cross Site Scripting (XSS) or Denial of Service (DoS)
Description:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2364	Version:	9
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02365 HP Release B.11.11 AND filesets tests hpuxwsAPACHE.PHP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.PHP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.0.59.07.01 OR Criteria meets HP Security Bulletin HPSBUX02365 platforms HP-UX B.11.31 AND HP Release B.11.23 AND filesets tests hpuxwsAPCH32.PHP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE2 version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.PHP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.APACHE version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.APACHE2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.AUTH_LDAP version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.AUTH_LDAP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_JK version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.PHP version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_JK2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.PHP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_PERL version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.WEBPROXY version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_PERL2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE version is less than B.2.0.59.07.01

Definition Id: oval:org.mitre.oval:def:7716

Oval ID:	oval:org.mitre.oval:def:7716
Title:	Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
Description:	Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-2939	Version:	8
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Apache
Definition Synopsis:
IF Apache HTTP Server 2.0.x is installed on the system AND The version of libhttpd.dll is less than 2.0.64 OR Apache HTTP Server 2.2.x is installed on the system AND The version of libhttpd.dll is less than 2.2.10

Definition Id: oval:org.mitre.oval:def:8361

Oval ID:	oval:org.mitre.oval:def:8361
Title:	DSA-1593 tomcat5.5 -- missing input sanitising
Description:	It was discovered that the Host Manager web application performed insufficient input sanitising, which could lead to cross-site scripting.
Family:	unix	Class:	patch
Reference(s):	DSA-1593 CVE-2008-1947	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	tomcat5.5
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND Installed architecture is all Packages section libtomcat5.5-java is earlier than 5.5.20-2etch3 AND tomcat5.5-admin is earlier than 5.5.20-2etch3 AND tomcat5.5-webapps is earlier than 5.5.20-2etch3 AND tomcat5.5 is earlier than 5.5.20-2etch3

Definition Id: oval:org.mitre.oval:def:8371

Oval ID:	oval:org.mitre.oval:def:8371
Title:	Apache 'mod_proxy_balancer' Cross-Site Request Forgery (CSRF) Vulnerability
Description:	Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-6420	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Apache
Definition Synopsis:
Apache HTTP Server 2.2.x is installed on the system AND The version of libhttpd.dll is less than 2.2.9

Definition Id: oval:org.mitre.oval:def:9577

Oval ID:	oval:org.mitre.oval:def:9577
Title:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Description:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2364	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section httpd-devel is earlier than 0:2.0.46-71.ent AND mod_ssl is earlier than 0:2.0.46-71.ent AND httpd is earlier than 0:2.0.46-71.ent OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section httpd-suexec is earlier than 0:2.0.52-41.ent.2 AND httpd-manual is earlier than 0:2.0.52-41.ent.2 AND httpd-devel is earlier than 0:2.0.52-41.ent.2 AND mod_ssl is earlier than 0:2.0.52-41.ent.2 AND httpd is earlier than 0:2.0.52-41.ent.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section httpd-manual is earlier than 0:2.2.3-11.el5_2.4 AND httpd-devel is earlier than 0:2.2.3-11.el5_2.4 AND mod_ssl is earlier than 0:2.2.3-11.el5_2.4 AND httpd is earlier than 0:2.2.3-11.el5_2.4

Definition Id: oval:org.mitre.oval:def:9724

Oval ID:	oval:org.mitre.oval:def:9724
Title:	Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Description:	Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-3658	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section php is earlier than 0:4.3.2-51.ent AND php-pgsql is earlier than 0:4.3.2-51.ent AND php-mysql is earlier than 0:4.3.2-51.ent AND php-ldap is earlier than 0:4.3.2-51.ent AND php-imap is earlier than 0:4.3.2-51.ent AND php-odbc is earlier than 0:4.3.2-51.ent AND php-devel is earlier than 0:4.3.2-51.ent OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section php-xmlrpc is earlier than 0:4.3.9-3.22.15 AND php-snmp is earlier than 0:4.3.9-3.22.15 AND php-domxml is earlier than 0:4.3.9-3.22.15 AND php-mysql is earlier than 0:4.3.9-3.22.15 AND php-imap is earlier than 0:4.3.9-3.22.15 AND php-gd is earlier than 0:4.3.9-3.22.15 AND php is earlier than 0:4.3.9-3.22.15 AND php-mbstring is earlier than 0:4.3.9-3.22.15 AND php-pgsql is earlier than 0:4.3.9-3.22.15 AND php-pear is earlier than 0:4.3.9-3.22.15 AND php-ldap is earlier than 0:4.3.9-3.22.15 AND php-odbc is earlier than 0:4.3.9-3.22.15 AND php-ncurses is earlier than 0:4.3.9-3.22.15 AND php-devel is earlier than 0:4.3.9-3.22.15 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section php-bcmath is earlier than 0:5.1.6-23.2.el5_3 AND php-soap is earlier than 0:5.1.6-23.2.el5_3 AND php-common is earlier than 0:5.1.6-23.2.el5_3 AND php-mysql is earlier than 0:5.1.6-23.2.el5_3 AND php-imap is earlier than 0:5.1.6-23.2.el5_3 AND php-gd is earlier than 0:5.1.6-23.2.el5_3 AND php is earlier than 0:5.1.6-23.2.el5_3 AND php-mbstring is earlier than 0:5.1.6-23.2.el5_3 AND php-pgsql is earlier than 0:5.1.6-23.2.el5_3 AND php-xml is earlier than 0:5.1.6-23.2.el5_3 AND php-ldap is earlier than 0:5.1.6-23.2.el5_3 AND php-odbc is earlier than 0:5.1.6-23.2.el5_3 AND php-ncurses is earlier than 0:5.1.6-23.2.el5_3 AND php-devel is earlier than 0:5.1.6-23.2.el5_3 AND php-xmlrpc is earlier than 0:5.1.6-23.2.el5_3 AND php-snmp is earlier than 0:5.1.6-23.2.el5_3 AND php-pdo is earlier than 0:5.1.6-23.2.el5_3 AND php-dba is earlier than 0:5.1.6-23.2.el5_3 AND php-cli is earlier than 0:5.1.6-23.2.el5_3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Http Server cpe:2.3:a:apache:http_server:2.2.9:::::::* cpe:2.3:a:apache:http_server:2.2.8:::::::* cpe:2.3:a:apache:http_server:2.2.7:::::::* cpe:2.3:a:apache:http_server:2.2.6:::::::* cpe:2.3:a:apache:http_server:2.2.5:::::::* cpe:2.3:a:apache:http_server:2.2.4:::::::* cpe:2.3:a:apache:http_server:2.2.3:::::::* cpe:2.3:a:apache:http_server:2.2.3::windows::::: cpe:2.3:a:apache:http_server:2.2.2:::::::* cpe:2.3:a:apache:http_server:2.2.2::windows::::: cpe:2.3:a:apache:http_server:2.2.1:::::::* cpe:2.3:a:apache:http_server:2.2.0:::::::* cpe:2.3:a:apache:http_server:2.2:::::::* cpe:2.3:a:apache:http_server:2.1.9:::::::* cpe:2.3:a:apache:http_server:2.1.8:::::::* cpe:2.3:a:apache:http_server:2.1.7:::::::* cpe:2.3:a:apache:http_server:2.1.6:::::::* cpe:2.3:a:apache:http_server:2.1.5:::::::* cpe:2.3:a:apache:http_server:2.1.4:::::::* cpe:2.3:a:apache:http_server:2.1.3:::::::* cpe:2.3:a:apache:http_server:2.1.2:::::::* cpe:2.3:a:apache:http_server:2.1.1:::::::* cpe:2.3:a:apache:http_server:2.1.0:::::::* cpe:2.3:a:apache:http_server:2.1:::::::* cpe:2.3:a:apache:http_server:2.0.9:::::::* cpe:2.3:a:apache:http_server:2.0.65:::::::* cpe:2.3:a:apache:http_server:2.0.64:::::::* cpe:2.3:a:apache:http_server:2.0.63:::::::* cpe:2.3:a:apache:http_server:2.0.61:::::::* cpe:2.3:a:apache:http_server:2.0.60:::::::* cpe:2.3:a:apache:http_server:2.0.59:::::::* cpe:2.3:a:apache:http_server:2.0.58:::::::* cpe:2.3:a:apache:http_server:2.0.58::win32::::: cpe:2.3:a:apache:http_server:2.0.57:::::::* cpe:2.3:a:apache:http_server:2.0.56:::::::* cpe:2.3:a:apache:http_server:2.0.55:::::::* cpe:2.3:a:apache:http_server:2.0.54:::::::* cpe:2.3:a:apache:http_server:2.0.53:::::::* cpe:2.3:a:apache:http_server:2.0.52:::::::* cpe:2.3:a:apache:http_server:2.0.51:::::::* cpe:2.3:a:apache:http_server:2.0.50:::::::* cpe:2.3:a:apache:http_server:2.0.49:::::::* cpe:2.3:a:apache:http_server:2.0.48:::::::* cpe:2.3:a:apache:http_server:2.0.47:::::::* cpe:2.3:a:apache:http_server:2.0.46:::::::* cpe:2.3:a:apache:http_server:2.0.46::win32::::: cpe:2.3:a:apache:http_server:2.0.45:::::::* cpe:2.3:a:apache:http_server:2.0.44:::::::* cpe:2.3:a:apache:http_server:2.0.43:::::::* cpe:2.3:a:apache:http_server:2.0.42:::::::* cpe:2.3:a:apache:http_server:2.0.41:::::::* cpe:2.3:a:apache:http_server:2.0.40:::::::* cpe:2.3:a:apache:http_server:2.0.39:::::::* cpe:2.3:a:apache:http_server:2.0.38:::::::* cpe:2.3:a:apache:http_server:2.0.37:::::::* cpe:2.3:a:apache:http_server:2.0.36:::::::* cpe:2.3:a:apache:http_server:2.0.35:::::::* cpe:2.3:a:apache:http_server:2.0.34:beta:::::: cpe:2.3:a:apache:http_server:2.0.34:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.34:::::::* cpe:2.3:a:apache:http_server:2.0.33:::::::* cpe:2.3:a:apache:http_server:2.0.32:beta:::::: cpe:2.3:a:apache:http_server:2.0.32:::::::* cpe:2.3:a:apache:http_server:2.0.32:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.31:::::::* cpe:2.3:a:apache:http_server:2.0.30:::::::* cpe:2.3:a:apache:http_server:2.0.29:::::::* cpe:2.3:a:apache:http_server:2.0.28:beta:::::: cpe:2.3:a:apache:http_server:2.0.28:::::::* cpe:2.3:a:apache:http_server:2.0.28:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.27:::::::* cpe:2.3:a:apache:http_server:2.0.26:::::::* cpe:2.3:a:apache:http_server:2.0.25:::::::* cpe:2.3:a:apache:http_server:2.0.24:::::::* cpe:2.3:a:apache:http_server:2.0.23:::::::* cpe:2.3:a:apache:http_server:2.0.22:::::::* cpe:2.3:a:apache:http_server:2.0.21:::::::* cpe:2.3:a:apache:http_server:2.0.20:::::::* cpe:2.3:a:apache:http_server:2.0.19:::::::* cpe:2.3:a:apache:http_server:2.0.18:::::::* cpe:2.3:a:apache:http_server:2.0.17:::::::* cpe:2.3:a:apache:http_server:2.0.16:::::::* cpe:2.3:a:apache:http_server:2.0.15:::::::* cpe:2.3:a:apache:http_server:2.0.14:::::::* cpe:2.3:a:apache:http_server:2.0.13:::::::* cpe:2.3:a:apache:http_server:2.0.12:::::::* cpe:2.3:a:apache:http_server:2.0.11:::::::* cpe:2.3:a:apache:http_server:2.0.0:::::::* cpe:2.3:a:apache:http_server:2.0:::::::* cpe:2.3:a:apache:http_server:2.0:alpha9:::::: cpe:2.3:a:apache:http_server:1.99:::::::* cpe:2.3:a:apache:http_server:1.4.0:::::::* cpe:2.3:a:apache:http_server:1.3.9:::::::* cpe:2.3:a:apache:http_server:1.3.9::win32::::: cpe:2.3:a:apache:http_server:1.3.8:::::::* cpe:2.3:a:apache:http_server:1.3.7:::::::* cpe:2.3:a:apache:http_server:1.3.7::dev::::: cpe:2.3:a:apache:http_server:1.3.68:::::::* cpe:2.3:a:apache:http_server:1.3.65:::::::* cpe:2.3:a:apache:http_server:1.3.6:::::::* cpe:2.3:a:apache:http_server:1.3.6::win32::::: cpe:2.3:a:apache:http_server:1.3.5:::::::* cpe:2.3:a:apache:http_server:1.3.42:::::::* cpe:2.3:a:apache:http_server:1.3.41:::::::* cpe:2.3:a:apache:http_server:1.3.40:::::::* cpe:2.3:a:apache:http_server:1.3.4:::::::* cpe:2.3:a:apache:http_server:1.3.39:::::::* cpe:2.3:a:apache:http_server:1.3.38:::::::* cpe:2.3:a:apache:http_server:1.3.37:::::::* cpe:2.3:a:apache:http_server:1.3.36:::::::* cpe:2.3:a:apache:http_server:1.3.35:::::::* cpe:2.3:a:apache:http_server:1.3.34:::::::* cpe:2.3:a:apache:http_server:1.3.33:::::::* cpe:2.3:a:apache:http_server:1.3.32:::::::* cpe:2.3:a:apache:http_server:1.3.31:::::::* cpe:2.3:a:apache:http_server:1.3.30:::::::* cpe:2.3:a:apache:http_server:1.3.3:::::::* cpe:2.3:a:apache:http_server:1.3.29:::::::* cpe:2.3:a:apache:http_server:1.3.28:::::::* cpe:2.3:a:apache:http_server:1.3.27:::::::* cpe:2.3:a:apache:http_server:1.3.26:::::::* cpe:2.3:a:apache:http_server:1.3.26::win32::::: cpe:2.3:a:apache:http_server:1.3.25:::::::* cpe:2.3:a:apache:http_server:1.3.25::win32::::: cpe:2.3:a:apache:http_server:1.3.24:::::::* cpe:2.3:a:apache:http_server:1.3.24::win32::::: cpe:2.3:a:apache:http_server:1.3.23:::::::* cpe:2.3:a:apache:http_server:1.3.23::win32::::: cpe:2.3:a:apache:http_server:1.3.22:::::::* cpe:2.3:a:apache:http_server:1.3.22::win32::::: cpe:2.3:a:apache:http_server:1.3.20:::::::* cpe:2.3:a:apache:http_server:1.3.20::win32::::: cpe:2.3:a:apache:http_server:1.3.2:::::::* cpe:2.3:a:apache:http_server:1.3.19:::::::* cpe:2.3:a:apache:http_server:1.3.19::win32::::: cpe:2.3:a:apache:http_server:1.3.18:::::::* cpe:2.3:a:apache:http_server:1.3.18::win32::::: cpe:2.3:a:apache:http_server:1.3.17:::::::* cpe:2.3:a:apache:http_server:1.3.17::win32::::: cpe:2.3:a:apache:http_server:1.3.16:::::::* cpe:2.3:a:apache:http_server:1.3.16::win32::::: cpe:2.3:a:apache:http_server:1.3.15:::::::* cpe:2.3:a:apache:http_server:1.3.15::win32::::: cpe:2.3:a:apache:http_server:1.3.14:::::::* cpe:2.3:a:apache:http_server:1.3.14::win32::::: cpe:2.3:a:apache:http_server:1.3.14::mac_os::::: cpe:2.3:a:apache:http_server:1.3.13:::::::* cpe:2.3:a:apache:http_server:1.3.13::win32::::: cpe:2.3:a:apache:http_server:1.3.12:::::::* cpe:2.3:a:apache:http_server:1.3.12::win32::::: cpe:2.3:a:apache:http_server:1.3.11:::::::* cpe:2.3:a:apache:http_server:1.3.11::win32::::: cpe:2.3:a:apache:http_server:1.3.10:::::::* cpe:2.3:a:apache:http_server:1.3.1.1:::::::* cpe:2.3:a:apache:http_server:1.3.1:::::::* cpe:2.3:a:apache:http_server:1.3.0:::::::* cpe:2.3:a:apache:http_server:1.3:::::::* cpe:2.3:a:apache:http_server:1.2.9:::::::* cpe:2.3:a:apache:http_server:1.2.6:::::::* cpe:2.3:a:apache:http_server:1.2.5:::::::* cpe:2.3:a:apache:http_server:1.2.4:::::::* cpe:2.3:a:apache:http_server:1.2.0:::::::* cpe:2.3:a:apache:http_server:1.15.17:::::::* cpe:2.3:a:apache:http_server:1.1.1:::::::* cpe:2.3:a:apache:http_server:1.1:::::::* cpe:2.3:a:apache:http_server:1.0.5:::::::* cpe:2.3:a:apache:http_server:1.0.3:::::::* cpe:2.3:a:apache:http_server:1.0.2:::::::* cpe:2.3:a:apache:http_server:1.0:::::::* cpe:2.3:a:apache:http_server:0.8.14:::::::* cpe:2.3:a:apache:http_server:0.8.11:::::::* cpe:2.3:a:apache:http_server:::::::: cpe:2.3:a:apache:http_server:::win32:::::* cpe:2.3:a:apache:http_server:-:::::::*	174
Application	Apache Tomcat cpe:2.3:a:apache:tomcat:6.0.9:::::::* cpe:2.3:a:apache:tomcat:6.0.9:beta:::::: cpe:2.3:a:apache:tomcat:6.0.8:::::::* cpe:2.3:a:apache:tomcat:6.0.8:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.7:::::::* cpe:2.3:a:apache:tomcat:6.0.7:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.7:beta:::::: cpe:2.3:a:apache:tomcat:6.0.6:::::::* cpe:2.3:a:apache:tomcat:6.0.6:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.5:::::::* cpe:2.3:a:apache:tomcat:6.0.4:::::::* cpe:2.3:a:apache:tomcat:6.0.4:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.3:::::::* cpe:2.3:a:apache:tomcat:6.0.2:::::::* cpe:2.3:a:apache:tomcat:6.0.2:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.2:beta:::::: cpe:2.3:a:apache:tomcat:6.0.16:::::::* cpe:2.3:a:apache:tomcat:6.0.15:::::::* cpe:2.3:a:apache:tomcat:6.0.14:::::::* cpe:2.3:a:apache:tomcat:6.0.13:::::::* cpe:2.3:a:apache:tomcat:6.0.12:::::::* cpe:2.3:a:apache:tomcat:6.0.11:::::::* cpe:2.3:a:apache:tomcat:6.0.10:::::::* cpe:2.3:a:apache:tomcat:6.0.1:::::::* cpe:2.3:a:apache:tomcat:6.0.1:alpha:::::: cpe:2.3:a:apache:tomcat:6.0.0:::::::* cpe:2.3:a:apache:tomcat:6.0.0:alpha:::::: cpe:2.3:a:apache:tomcat:6.0:::::::* cpe:2.3:a:apache:tomcat:6:::::::* cpe:2.3:a:apache:tomcat:5.5.9:::::::* cpe:2.3:a:apache:tomcat:5.5.8:::::::* cpe:2.3:a:apache:tomcat:5.5.7:::::::* cpe:2.3:a:apache:tomcat:5.5.6:::::::* cpe:2.3:a:apache:tomcat:5.5.5:::::::* cpe:2.3:a:apache:tomcat:5.5.4:::::::* cpe:2.3:a:apache:tomcat:5.5.35:::::::* cpe:2.3:a:apache:tomcat:5.5.34:::::::* cpe:2.3:a:apache:tomcat:5.5.33:::::::* cpe:2.3:a:apache:tomcat:5.5.32:::::::* cpe:2.3:a:apache:tomcat:5.5.31:::::::* cpe:2.3:a:apache:tomcat:5.5.30:::::::* cpe:2.3:a:apache:tomcat:5.5.3:::::::* cpe:2.3:a:apache:tomcat:5.5.29:::::::* cpe:2.3:a:apache:tomcat:5.5.28:::::::* cpe:2.3:a:apache:tomcat:5.5.27:::::::* cpe:2.3:a:apache:tomcat:5.5.26:::::::* cpe:2.3:a:apache:tomcat:5.5.25:::::::* cpe:2.3:a:apache:tomcat:5.5.24:::::::* cpe:2.3:a:apache:tomcat:5.5.23:::::::* cpe:2.3:a:apache:tomcat:5.5.22:::::::* cpe:2.3:a:apache:tomcat:5.5.21:::::::* cpe:2.3:a:apache:tomcat:5.5.20:::::::* cpe:2.3:a:apache:tomcat:5.5.2:::::::* cpe:2.3:a:apache:tomcat:5.5.19:::::::* cpe:2.3:a:apache:tomcat:5.5.18:::::::* cpe:2.3:a:apache:tomcat:5.5.17:::::::* cpe:2.3:a:apache:tomcat:5.5.16:::::::* cpe:2.3:a:apache:tomcat:5.5.15:::::::* cpe:2.3:a:apache:tomcat:5.5.14:::::::* cpe:2.3:a:apache:tomcat:5.5.13:::::::* cpe:2.3:a:apache:tomcat:5.5.12:::::::* cpe:2.3:a:apache:tomcat:5.5.11:::::::* cpe:2.3:a:apache:tomcat:5.5.10:::::::* cpe:2.3:a:apache:tomcat:5.5.1:::::::* cpe:2.3:a:apache:tomcat:5.5.0:::::::* cpe:2.3:a:apache:tomcat:5.0.9:::::::* cpe:2.3:a:apache:tomcat:5.0.8:::::::* cpe:2.3:a:apache:tomcat:5.0.7:::::::* cpe:2.3:a:apache:tomcat:5.0.6:::::::* cpe:2.3:a:apache:tomcat:5.0.5:::::::* cpe:2.3:a:apache:tomcat:5.0.4:::::::* cpe:2.3:a:apache:tomcat:5.0.30:::::::* cpe:2.3:a:apache:tomcat:5.0.3:::::::* cpe:2.3:a:apache:tomcat:5.0.29:::::::* cpe:2.3:a:apache:tomcat:5.0.28:::::::* cpe:2.3:a:apache:tomcat:5.0.27:::::::* cpe:2.3:a:apache:tomcat:5.0.26:::::::* cpe:2.3:a:apache:tomcat:5.0.25:::::::* cpe:2.3:a:apache:tomcat:5.0.24:::::::* cpe:2.3:a:apache:tomcat:5.0.23:::::::* cpe:2.3:a:apache:tomcat:5.0.22:::::::* cpe:2.3:a:apache:tomcat:5.0.21:::::::* cpe:2.3:a:apache:tomcat:5.0.2:::::::* cpe:2.3:a:apache:tomcat:5.0.19:::::::* cpe:2.3:a:apache:tomcat:5.0.18:::::::* cpe:2.3:a:apache:tomcat:5.0.17:::::::* cpe:2.3:a:apache:tomcat:5.0.16:::::::* cpe:2.3:a:apache:tomcat:5.0.15:::::::* cpe:2.3:a:apache:tomcat:5.0.14:::::::* cpe:2.3:a:apache:tomcat:5.0.13:::::::* cpe:2.3:a:apache:tomcat:5.0.12:::::::* cpe:2.3:a:apache:tomcat:5.0.11:::::::* cpe:2.3:a:apache:tomcat:5.0.10:::::::* cpe:2.3:a:apache:tomcat:5.0.1:::::::* cpe:2.3:a:apache:tomcat:5.0.0:::::::* cpe:2.3:a:apache:tomcat:5:::::::* cpe:2.3:a:apache:tomcat:4.1.9:beta:::::: cpe:2.3:a:apache:tomcat:4.1.9:::::::* cpe:2.3:a:apache:tomcat:4.1.8:::::::* cpe:2.3:a:apache:tomcat:4.1.7:::::::* cpe:2.3:a:apache:tomcat:4.1.6:::::::* cpe:2.3:a:apache:tomcat:4.1.5:::::::* cpe:2.3:a:apache:tomcat:4.1.40:::::::* cpe:2.3:a:apache:tomcat:4.1.4:::::::* cpe:2.3:a:apache:tomcat:4.1.39:::::::* cpe:2.3:a:apache:tomcat:4.1.38:::::::* cpe:2.3:a:apache:tomcat:4.1.37:::::::* cpe:2.3:a:apache:tomcat:4.1.36:::::::* cpe:2.3:a:apache:tomcat:4.1.35:::::::* cpe:2.3:a:apache:tomcat:4.1.34:::::::* cpe:2.3:a:apache:tomcat:4.1.33:::::::* cpe:2.3:a:apache:tomcat:4.1.32:::::::* cpe:2.3:a:apache:tomcat:4.1.31:::::::* cpe:2.3:a:apache:tomcat:4.1.30:::::::* cpe:2.3:a:apache:tomcat:4.1.3:::::::* cpe:2.3:a:apache:tomcat:4.1.3:beta:::::: cpe:2.3:a:apache:tomcat:4.1.29:::::::* cpe:2.3:a:apache:tomcat:4.1.29:alpha:::::: cpe:2.3:a:apache:tomcat:4.1.28:::::::* cpe:2.3:a:apache:tomcat:4.1.28:alpha:::::: cpe:2.3:a:apache:tomcat:4.1.27:::::::* cpe:2.3:a:apache:tomcat:4.1.26:::::::* cpe:2.3:a:apache:tomcat:4.1.25:::::::* cpe:2.3:a:apache:tomcat:4.1.24:::::::* cpe:2.3:a:apache:tomcat:4.1.23:::::::* cpe:2.3:a:apache:tomcat:4.1.22:::::::* cpe:2.3:a:apache:tomcat:4.1.21:::::::* cpe:2.3:a:apache:tomcat:4.1.20:::::::* cpe:2.3:a:apache:tomcat:4.1.2:::::::* cpe:2.3:a:apache:tomcat:4.1.19:::::::* cpe:2.3:a:apache:tomcat:4.1.18:::::::* cpe:2.3:a:apache:tomcat:4.1.17:::::::* cpe:2.3:a:apache:tomcat:4.1.16:::::::* cpe:2.3:a:apache:tomcat:4.1.15:::::::* cpe:2.3:a:apache:tomcat:4.1.14:::::::* cpe:2.3:a:apache:tomcat:4.1.13:::::::* cpe:2.3:a:apache:tomcat:4.1.12:::::::* cpe:2.3:a:apache:tomcat:4.1.11:::::::* cpe:2.3:a:apache:tomcat:4.1.10:::::::* cpe:2.3:a:apache:tomcat:4.1.1:::::::* cpe:2.3:a:apache:tomcat:4.1.0:::::::* cpe:2.3:a:apache:tomcat:4.0.6:::::::* cpe:2.3:a:apache:tomcat:4.0.5:::::::* cpe:2.3:a:apache:tomcat:4.0.4:::::::* cpe:2.3:a:apache:tomcat:4.0.3:::::::* cpe:2.3:a:apache:tomcat:4.0.2:::::::* cpe:2.3:a:apache:tomcat:4.0.1:::::::* cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache:tomcat:4:::::::* cpe:2.3:a:apache:tomcat:3.3.2:::::::* cpe:2.3:a:apache:tomcat:3.3.1a:::::::* cpe:2.3:a:apache:tomcat:3.3.1:::::::* cpe:2.3:a:apache:tomcat:3.3:::::::* cpe:2.3:a:apache:tomcat:3.2.4:::::::* cpe:2.3:a:apache:tomcat:3.2.3:::::::* cpe:2.3:a:apache:tomcat:3.2.2:::::::* cpe:2.3:a:apache:tomcat:3.2.2:beta2:::::: cpe:2.3:a:apache:tomcat:3.2.1:::::::* cpe:2.3:a:apache:tomcat:3.2:::::::* cpe:2.3:a:apache:tomcat:3.1.1:::::::* cpe:2.3:a:apache:tomcat:3.1:::::::* cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache:tomcat:1.1.3:::::::* cpe:2.3:a:apache:tomcat:::::::: cpe:2.3:a:apache:tomcat:-:::::::*	165
Application	Apple Mac Os X cpe:2.3:a:apple:mac_os_x:10.5.6:::::::* cpe:2.3:a:apple:mac_os_x::::::::	2
Application	Php cpe:2.3:a:php:php:5.2.6:-:::::: cpe:2.3:a:php:php:5.2.5:-:::::: cpe:2.3:a:php:php:5.2.4:-:::::: cpe:2.3:a:php:php:5.2.3:-:::::: cpe:2.3:a:php:php:5.2.2:-:::::: cpe:2.3:a:php:php:5.2.1:-:::::: cpe:2.3:a:php:php:5.2.0:::::::* cpe:2.3:a:php:php:4.4.8:-:::::: cpe:2.3:a:php:php:4.4.7:-:::::: cpe:2.3:a:php:php:4.4.6:-:::::: cpe:2.3:a:php:php:4.4.5:-:::::: cpe:2.3:a:php:php:4.4.4:-:::::: cpe:2.3:a:php:php:4.4.3:-:::::: cpe:2.3:a:php:php:4.4.2:-:::::: cpe:2.3:a:php:php:4.4.1:-:::::: cpe:2.3:a:php:php:4.4.0:-::::::	16
Os	Apple Mac Os X cpe:2.3:o:apple:mac_os_x:10.5.6:::::::* cpe:2.3:o:apple:mac_os_x:10.5.5:::::::* cpe:2.3:o:apple:mac_os_x:10.5.4:::::::* cpe:2.3:o:apple:mac_os_x:10.5.3:::::::* cpe:2.3:o:apple:mac_os_x:10.5.2:::::::* cpe:2.3:o:apple:mac_os_x:10.5.2:2008-002:::::: cpe:2.3:o:apple:mac_os_x:10.5.1:::::::* cpe:2.3:o:apple:mac_os_x:10.5.0:::::::* cpe:2.3:o:apple:mac_os_x:10.5:::::::* cpe:2.3:o:apple:mac_os_x:10.4.9:::::::* cpe:2.3:o:apple:mac_os_x:10.4.8:::::::* cpe:2.3:o:apple:mac_os_x:10.4.8::macbook::::: cpe:2.3:o:apple:mac_os_x:10.4.8::mac_mini::::: cpe:2.3:o:apple:mac_os_x:10.4.8::macbook_pro::::: cpe:2.3:o:apple:mac_os_x:10.4.7:::::::* cpe:2.3:o:apple:mac_os_x:10.4.6:::::::* cpe:2.3:o:apple:mac_os_x:10.4.5:::::::* cpe:2.3:o:apple:mac_os_x:10.4.4:::::::* cpe:2.3:o:apple:mac_os_x:10.4.3:::::::* cpe:2.3:o:apple:mac_os_x:10.4.2:::::::* cpe:2.3:o:apple:mac_os_x:10.4.11:::::::* cpe:2.3:o:apple:mac_os_x:10.4.10:::::::* cpe:2.3:o:apple:mac_os_x:10.4.1:::::::* cpe:2.3:o:apple:mac_os_x:10.4.0:::::::* cpe:2.3:o:apple:mac_os_x:10.4.:::::::* cpe:2.3:o:apple:mac_os_x:10.4:::::::* cpe:2.3:o:apple:mac_os_x:10.3.9:::::::* cpe:2.3:o:apple:mac_os_x:10.3.8:::::::* cpe:2.3:o:apple:mac_os_x:10.3.7:::::::* cpe:2.3:o:apple:mac_os_x:10.3.6:::::::* cpe:2.3:o:apple:mac_os_x:10.3.5:::::::* cpe:2.3:o:apple:mac_os_x:10.3.4:::::::* cpe:2.3:o:apple:mac_os_x:10.3.3:::::::* cpe:2.3:o:apple:mac_os_x:10.3.2:::::::* cpe:2.3:o:apple:mac_os_x:10.3.1:::::::* cpe:2.3:o:apple:mac_os_x:10.3.0:::::::* cpe:2.3:o:apple:mac_os_x:10.3:::::::* cpe:2.3:o:apple:mac_os_x:10.2.8:::::::* cpe:2.3:o:apple:mac_os_x:10.2.7:::::::* cpe:2.3:o:apple:mac_os_x:10.2.6:::::::* cpe:2.3:o:apple:mac_os_x:10.2.5:::::::* cpe:2.3:o:apple:mac_os_x:10.2.4:::::::* cpe:2.3:o:apple:mac_os_x:10.2.3:::::::* cpe:2.3:o:apple:mac_os_x:10.2.2:::::::* cpe:2.3:o:apple:mac_os_x:10.2.1:::::::* cpe:2.3:o:apple:mac_os_x:10.2.0:::::::* cpe:2.3:o:apple:mac_os_x:10.2:::::::* cpe:2.3:o:apple:mac_os_x:10.1.5:::::::* cpe:2.3:o:apple:mac_os_x:10.1.4:::::::* cpe:2.3:o:apple:mac_os_x:10.1.3:::::::* cpe:2.3:o:apple:mac_os_x:10.1.2:::::::* cpe:2.3:o:apple:mac_os_x:10.1.1:::::::* cpe:2.3:o:apple:mac_os_x:10.1.0:::::::* cpe:2.3:o:apple:mac_os_x:10.1:::::::* cpe:2.3:o:apple:mac_os_x:10.0.4:::::::* cpe:2.3:o:apple:mac_os_x:10.0.3:::::::* cpe:2.3:o:apple:mac_os_x:10.0.2:::::::* cpe:2.3:o:apple:mac_os_x:10.0.1:::::::* cpe:2.3:o:apple:mac_os_x:10.0.0:::::::* cpe:2.3:o:apple:mac_os_x:10.0:::::::* cpe:2.3:o:apple:mac_os_x:::::::: cpe:2.3:o:apple:mac_os_x:-:::::::*	62
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:8.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:7.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts::: cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*	5
Os	Fedoraproject Fedora cpe:2.3:o:fedoraproject:fedora:9:::::::* cpe:2.3:o:fedoraproject:fedora:8:::::::*	2
Os	Opensuse cpe:2.3:o:opensuse:opensuse:11.0:::::::* cpe:2.3:o:opensuse:opensuse:10.3:::::::* cpe:2.3:o:opensuse:opensuse:10.2:::::::*	3
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*	3
Os	Redhat Enterprise Linux Eus cpe:2.3:o:redhat:enterprise_linux_eus:5.2:::::::* cpe:2.3:o:redhat:enterprise_linux_eus:4.7:::::::*	2
Os	Redhat Enterprise Linux Server cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::* cpe:2.3:o:redhat:enterprise_linux_server:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_server:3.0:::::::*	3
Os	Redhat Enterprise Linux Workstation cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::* cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:::::::*	3

ExploitDB Exploits

id	Description
2009-11-07	ToutVirtual VirtualIQ Pro 3.2 Multiple Vulnerabilities
2008-08-11	Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability

OpenVAS Exploits

Date	Description
2012-06-21	Name : PHP < 4.4.9 File : nvt/nopsec_php_4_4_9.nasl
2012-06-21	Name : PHP version smaller than 5.2.7 File : nvt/nopsec_php_5_2_7.nasl
2011-08-09	Name : CentOS Update for php CESA-2009:0338 centos5 i386 File : nvt/gb_CESA-2009_0338_php_centos5_i386.nasl
2011-08-09	Name : CentOS Update for php CESA-2009:0337 centos4 i386 File : nvt/gb_CESA-2009_0337_php_centos4_i386.nasl
2011-08-09	Name : CentOS Update for php CESA-2009:0337 centos3 i386 File : nvt/gb_CESA-2009_0337_php_centos3_i386.nasl
2010-05-12	Name : Mac OS X 10.5.7 Update / Mac OS X Security Update 2009-002 File : nvt/macosx_upd_10_5_7_secupd_2009-002.nasl
2010-05-12	Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl
2010-04-19	Name : PHP Multiple Buffer Overflow Vulnerabilities File : nvt/gb_php_30649.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:323 (apache) File : nvt/mdksa_2009_323.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-22	Name : HP-UX Update for Apache-based Web Server HPSBUX02465 File : nvt/gb_hp_ux_HPSBUX02465.nasl
2009-10-13	Name : SLES10: Security update for Apache 2 File : nvt/sles10_apache2.nasl
2009-10-13	Name : SLES10: Security update for Apache 2 File : nvt/sles10_apache20.nasl
2009-10-13	Name : SLES10: Security update for Tomcat 5 File : nvt/sles10_tomcat51.nasl
2009-10-13	Name : SLES10: Security update for Websphere Community Edition File : nvt/sles10_websphere-as_ce0.nasl
2009-10-13	Name : SLES10: Security update for PHP5 File : nvt/sles10_apache2-mod_php1.nasl
2009-10-10	Name : SLES9: Security update for Tomcat File : nvt/sles9p5035120.nasl
2009-10-10	Name : SLES9: Security update for Apache 2 File : nvt/sles9p5037600.nasl
2009-07-15	Name : Mandrake Security Advisory MDVSA-2009:124-1 (apache) File : nvt/mdksa_2009_124_1.nasl
2009-06-05	Name : Mandrake Security Advisory MDVSA-2009:124 (apache) File : nvt/mdksa_2009_124.nasl
2009-06-05	Name : Ubuntu USN-719-1 (libpam-krb5) File : nvt/ubuntu_719_1.nasl
2009-06-05	Name : Fedora Core 9 FEDORA-2009-3848 (maniadrive) File : nvt/fcore_2009_3848.nasl
2009-06-05	Name : Fedora Core 10 FEDORA-2009-3768 (maniadrive) File : nvt/fcore_2009_3768.nasl
2009-06-05	Name : Ubuntu USN-720-1 (php5) File : nvt/ubuntu_720_1.nasl
2009-06-05	Name : Ubuntu USN-723-1 (git-core) File : nvt/ubuntu_723_1.nasl
2009-06-03	Name : Solaris Update for Apache 2 120543-14 File : nvt/gb_solaris_120543_14.nasl
2009-06-03	Name : Solaris Update for Apache 2 120544-14 File : nvt/gb_solaris_120544_14.nasl
2009-05-05	Name : HP-UX Update for Apache HPSBUX02365 File : nvt/gb_hp_ux_HPSBUX02365.nasl
2009-05-05	Name : HP-UX Update for Apache Web Server Suite HPSBUX02401 File : nvt/gb_hp_ux_HPSBUX02401.nasl
2009-04-15	Name : CentOS Security Advisory CESA-2009:0338 (php) File : nvt/ovcesa2009_0338.nasl
2009-04-15	Name : CentOS Security Advisory CESA-2009:0337 (php) File : nvt/ovcesa2009_0337.nasl
2009-04-15	Name : RedHat Security Advisory RHSA-2009:0338 File : nvt/RHSA_2009_0338.nasl
2009-04-15	Name : RedHat Security Advisory RHSA-2009:0350 File : nvt/RHSA_2009_0350.nasl
2009-04-15	Name : RedHat Security Advisory RHSA-2009:0337 File : nvt/RHSA_2009_0337.nasl
2009-04-09	Name : Mandriva Update for apache MDVSA-2008:195 (apache) File : nvt/gb_mandriva_MDVSA_2008_195.nasl
2009-04-09	Name : Mandriva Update for tomcat5 MDVSA-2008:188 (tomcat5) File : nvt/gb_mandriva_MDVSA_2008_188.nasl
2009-03-31	Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl
2009-03-13	Name : SuSE Security Summary SUSE-SR:2009:006 File : nvt/suse_sr_2009_006.nasl
2009-03-13	Name : Ubuntu USN-731-1 (apache2) File : nvt/ubuntu_731_1.nasl
2009-03-13	Name : FreeBSD Ports: apache File : nvt/freebsd_apache14.nasl
2009-03-06	Name : RedHat Update for tomcat RHSA-2008:0648-01 File : nvt/gb_RHSA-2008_0648-01_tomcat.nasl
2009-03-06	Name : RedHat Update for httpd RHSA-2008:0967-01 File : nvt/gb_RHSA-2008_0967-01_httpd.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos3 i386 File : nvt/gb_CESA-2008_0967_httpd_centos3_i386.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos3 x86_64 File : nvt/gb_CESA-2008_0967_httpd_centos3_x86_64.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos4 i386 File : nvt/gb_CESA-2008_0967_httpd_centos4_i386.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos4 x86_64 File : nvt/gb_CESA-2008_0967_httpd_centos4_x86_64.nasl
2009-02-18	Name : SuSE Security Summary SUSE-SR:2009:004 File : nvt/suse_sr_2009_004.nasl
2009-02-17	Name : Fedora Update for tomcat5 FEDORA-2008-8130 File : nvt/gb_fedora_2008_8130_tomcat5_fc8.nasl
2009-02-17	Name : Fedora Update for tomcat5 FEDORA-2008-8113 File : nvt/gb_fedora_2008_8113_tomcat5_fc9.nasl
2009-02-17	Name : Fedora Update for tomcat6 FEDORA-2008-7977 File : nvt/gb_fedora_2008_7977_tomcat6_fc9.nasl
2009-02-17	Name : Fedora Update for httpd FEDORA-2008-6393 File : nvt/gb_fedora_2008_6393_httpd_fc9.nasl
2009-02-17	Name : Fedora Update for httpd FEDORA-2008-6314 File : nvt/gb_fedora_2008_6314_httpd_fc8.nasl
2009-01-26	Name : Mandrake Security Advisory MDVSA-2009:023 (php) File : nvt/mdksa_2009_023.nasl
2009-01-26	Name : Mandrake Security Advisory MDVSA-2009:021 (php) File : nvt/mdksa_2009_021.nasl
2009-01-26	Name : Mandrake Security Advisory MDVSA-2009:024 (php4) File : nvt/mdksa_2009_024.nasl
2009-01-26	Name : Mandrake Security Advisory MDVSA-2009:022 (php) File : nvt/mdksa_2009_022.nasl
2008-12-10	Name : FreeBSD Ports: php5 File : nvt/freebsd_php54.nasl
2008-11-19	Name : Gentoo Security Advisory GLSA 200811-05 (php) File : nvt/glsa_200811_05.nasl
2008-10-09	Name : Debian Security Advisory DSA 1647-1 (php5) File : nvt/deb_1647_1.nasl
2008-09-25	Name : IBM HTTP Server mod_proxy Interim Responses DoS Vulnerability File : nvt/secpod_ibmhttpserver_mod_proxy_dos_900222.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200807-06 (apache) File : nvt/glsa_200807_06.nasl
2008-09-04	Name : FreeBSD Ports: apache File : nvt/freebsd_apache13.nasl
2008-08-22	Name : Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability File : nvt/secpod_apache_mod_proxy_ftp_xss_vuln_900107.nasl
2008-08-07	Name : Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities File : nvt/secpod_apache_tomcat_xss_n_bypass_vuln_900021.nasl
2008-06-11	Name : Debian Security Advisory DSA 1593-1 (tomcat5.5) File : nvt/deb_1593_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2008-339-01 php File : nvt/esoft_slk_ssa_2008_339_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
62511	CA Service Desk Tomcat host-manager/html/add name Parameter XSS CA Service Desk Tomcat contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'name' parameter upon submission to the 'host-manager/html/add' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
47798	PHP ext/gd/gd.c imageloadfont Function Crafted Font File Handling Overflow
47474	Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS
47464	Apache Tomcat allowLinking / UTF-8 Traversal Arbitrary File Access
47463	Apache Tomcat RequestDispatcher Traversal Arbitrary File Access
47462	Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS
46085	Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interi...
45905	Apache Tomcat Host Manager host-manager/html/add name Parameter XSS
42937	Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF

Snort® IPS/IDS

Date	Description
2014-01-10	Multiple Products IFRAME src javascript code execution RuleID : 3679 - Revision : 18 - Type : INDICATOR-OBFUSCATION
2014-01-10	Apache Tomcat allowLinking URIencoding directory traversal attempt RuleID : 17387 - Revision : 11 - Type : SERVER-APACHE

Nessus® Vulnerability Scanner

Date	Description
2016-03-03	Name : The remote host is missing a security-related patch. File : vmware_VMSA-2009-0016_remote.nasl - Type : ACT_GATHER_INFO
2014-10-10	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL9110.nasl - Type : ACT_GATHER_INFO
2013-08-11	Name : The remote web server may be affected by multiple vulnerabilities. File : oracle_http_server_cpu_jul_2013.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0338.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0337.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0648.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-0877.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090406_php_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20081111_httpd_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080827_tomcat_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2010-10-20	Name : The remote web server is affected by multiple vulnerabilities. File : apache_2_0_64.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_18.nasl - Type : ACT_GATHER_INFO
2010-06-11	Name : The remote web server is affected by multiple vulnerabilities. File : tomcat_4_1_39.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-1007.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0648.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0338.nasl - Type : ACT_GATHER_INFO
2009-12-08	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-323.nasl - Type : ACT_GATHER_INFO
2009-11-23	Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2009-0016.nasl - Type : ACT_GATHER_INFO
2009-10-19	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2009-0002.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12232.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12258.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-6035.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-5580.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_websphere-as_ce-5850.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_apache2-mod_php5-080820.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_tomcat6-080821.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_tomcat6-080702.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_apache2-080925.nasl - Type : ACT_GATHER_INFO
2009-06-01	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-124.nasl - Type : ACT_GATHER_INFO
2009-06-01	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-3848.nasl - Type : ACT_GATHER_INFO
2009-06-01	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-3768.nasl - Type : ACT_GATHER_INFO
2009-05-13	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-002.nasl - Type : ACT_GATHER_INFO
2009-05-13	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_7.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-720-1.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-022.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-021.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-195.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-188.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-731-1.nasl - Type : ACT_GATHER_INFO
2009-04-07	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0337.nasl - Type : ACT_GATHER_INFO
2009-04-07	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0337.nasl - Type : ACT_GATHER_INFO
2009-04-07	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0338.nasl - Type : ACT_GATHER_INFO
2009-03-13	Name : The remote openSUSE host is missing a security update. File : suse_apache2-6054.nasl - Type : ACT_GATHER_INFO
2009-03-12	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_f18920660e7411de92de000bcdc1757a.nasl - Type : ACT_GATHER_INFO
2008-12-08	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_27d01223c45711dda7210030843d3802.nasl - Type : ACT_GATHER_INFO
2008-12-05	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2008-339-01.nasl - Type : ACT_GATHER_INFO
2008-12-05	Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_2_7.nasl - Type : ACT_GATHER_INFO
2008-11-17	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200811-05.nasl - Type : ACT_GATHER_INFO
2008-11-16	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-5767.nasl - Type : ACT_GATHER_INFO
2008-11-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2008-11-05	Name : The remote openSUSE host is missing a security update. File : suse_apache2-5628.nasl - Type : ACT_GATHER_INFO
2008-11-05	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-5629.nasl - Type : ACT_GATHER_INFO
2008-11-05	Name : The remote openSUSE host is missing a security update. File : suse_apache2-5648.nasl - Type : ACT_GATHER_INFO
2008-10-16	Name : The remote web server is vulnerable to a cross-site scripting attack. File : apache_mod_proxy_ftp_glob_xss.nasl - Type : ACT_ATTACK
2008-10-16	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-5661.nasl - Type : ACT_GATHER_INFO
2008-10-10	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO
2008-10-07	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1647.nasl - Type : ACT_GATHER_INFO
2008-09-17	Name : The remote Fedora host is missing a security update. File : fedora_2008-8113.nasl - Type : ACT_GATHER_INFO
2008-09-17	Name : The remote Fedora host is missing a security update. File : fedora_2008-8130.nasl - Type : ACT_GATHER_INFO
2008-09-17	Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-5546.nasl - Type : ACT_GATHER_INFO
2008-09-12	Name : The remote Fedora host is missing a security update. File : fedora_2008-7977.nasl - Type : ACT_GATHER_INFO
2008-09-11	Name : The remote openSUSE host is missing a security update. File : suse_tomcat55-5547.nasl - Type : ACT_GATHER_INFO
2008-09-10	Name : The remote openSUSE host is missing a security update. File : suse_tomcat5-5542.nasl - Type : ACT_GATHER_INFO
2008-09-10	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_tomcat5-5539.nasl - Type : ACT_GATHER_INFO
2008-08-28	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0648.nasl - Type : ACT_GATHER_INFO
2008-08-12	Name : The remote web server is affected by a directory traversal vulnerability. File : tomcat_utf8_dir_traversal.nasl - Type : ACT_ATTACK
2008-08-08	Name : The remote Fedora host is missing a security update. File : fedora_2008-6393.nasl - Type : ACT_GATHER_INFO
2008-08-08	Name : The remote Fedora host is missing a security update. File : fedora_2008-6314.nasl - Type : ACT_GATHER_INFO
2008-08-08	Name : The remote web server uses a version of PHP that is affected by multiple issues. File : php_4_4_9.nasl - Type : ACT_GATHER_INFO
2008-07-11	Name : The remote web server may be affected by several issues. File : apache_2_2_9.nasl - Type : ACT_GATHER_INFO
2008-07-10	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200807-06.nasl - Type : ACT_GATHER_INFO
2008-07-08	Name : The remote openSUSE host is missing a security update. File : suse_tomcat55-5385.nasl - Type : ACT_GATHER_INFO
2008-06-24	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_c84dc9ad41f711dda4f900163e000016.nasl - Type : ACT_GATHER_INFO
2008-06-16	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1593.nasl - Type : ACT_GATHER_INFO

Global Informations

Type	Count
CWE ID(s)	8
Oval ID(s)	21
CPE ID(s)	440
osvdb(s)	9
ExploitDB Exploit(s)	2
Openvas Exploit(s)	66
Snort® Rule(s)	2
Nessus® Exploit(s)	76

	Related
7.5	CVE-2008-3658
5	CVE-2008-2370
5	CVE-2008-2364
4.3	CVE-2008-2939
4.3	CVE-2008-2938
4.3	CVE-2008-1947
4.3	CVE-2008-1232
4.3	CVE-2007-6420
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 8 more Alert(s)