Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (377 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2003-0411 2 Microsoft, Oracle 3 Windows 2000, Windows Xp, Sun One Application Server 2025-04-03 7.5 High
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension.
CVE-2000-0497 1 Ibm 1 Websphere Application Server 2025-04-03 7.5 High
IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
CVE-2005-2919 1 Clam Anti-virus 1 Clamav 2025-04-03 N/A
libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.
CVE-2000-0498 1 Unify 1 Ewave Servletexec 2025-04-03 7.5 High
Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
CVE-2005-0269 1 Sir 1 Gnuboard 2025-04-03 9.8 Critical
The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters.
CVE-2001-0766 2 Apache, Apple 2 Http Server, Mac Os X 2025-04-03 9.8 Critical
Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
CVE-1999-0179 1 Microsoft 2 Windows 95, Windows Nt 2025-04-03 N/A
Windows NT crashes or locks up when a Samba client executes a "cd .." command on a file share.
CVE-2002-0485 1 Symantec 1 Norton Antivirus 2025-04-03 7.5 High
Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients.
CVE-2001-0795 1 Cmfperception 1 Liteserve 2025-04-03 7.5 High
Perception LiteServe 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters or (2) 8.3 file names.
CVE-2004-2154 3 Apple, Canonical, Redhat 3 Cups, Ubuntu Linux, Enterprise Linux 2025-04-03 9.8 Critical
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
CVE-2004-2214 1 Mbedthis 1 Appweb Http Server 2025-04-03 9.8 Critical
Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters.
CVE-1999-0239 1 Netscape 1 Fasttrack Server 2025-04-03 7.5 High
Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET.
CVE-2004-1083 1 Apple 4 Darwin Streaming Server, Mac Os X, Mac Os X Server and 1 more 2025-04-03 7.5 High
Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
CVE-2005-0138 1 Sgi 1 Irix 2025-04-03 N/A
rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE definition of a vulnerability.
CVE-2002-1820 1 Ultimate Php Board Project 1 Ultimate Php Board 2025-04-03 9.8 Critical
register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."
CVE-2006-2759 1 Jetty 1 Jetty 2025-04-03 5.3 Medium
jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations.
CVE-2023-24021 3 Debian, Redhat, Trustwave 3 Debian Linux, Jboss Core Services, Modsecurity 2025-04-02 7.5 High
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
CVE-2022-3854 1 Redhat 1 Ceph Storage 2025-03-06 6.5 Medium
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
CVE-2022-49045 2025-03-02 5.5 Medium
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-27110 2025-02-26 8.6 High
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.