4.3
CVSSv2

CVE-2012-3499

Published: 26/02/2013 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 388
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x prior to 2.2.24-dev and 2.4.x prior to 2.4.4 allow remote malicious users to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server 2.2.23

apache http server 2.2

apache http server 2.2.11

apache http server 2.2.0

apache http server 2.2.10

apache http server 2.2.13

apache http server 2.2.2

apache http server 2.2.4

apache http server 2.2.17

apache http server 2.2.16

apache http server 2.2.21

apache http server 2.2.8

apache http server 2.2.14

apache http server 2.2.6

apache http server 2.2.22

apache http server 2.2.19

apache http server 2.2.9

apache http server 2.2.18

apache http server 2.2.12

apache http server 2.2.3

apache http server 2.2.15

apache http server 2.2.20

apache http server 2.2.1

apache http server 2.4.1

apache http server 2.4.0

apache http server 2.4.3

apache http server 2.4.2

Vendor Advisories

Synopsis Moderate: httpd security update Type/Severity Security Advisory: Moderate Topic Updated httpd packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerabi ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 611 update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Enterprise Application Platform 611, which fixes multiplesecurity issues, various bugs, and adds enhancements, is now available forRed Hat Enterprise Linux 5The Red ...
Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 611 update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Enterprise Application Platform 611, which fixes multiplesecurity issues, various bugs, and adds enhancements, is now available forRed Hat Enterprise Linux 6The Red ...
Several vulnerabilities have been found in the Apache HTTPD server CVE-2012-3499 The modules mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp did not properly escape hostnames and URIs in HTML output, causing cross site scripting vulnerabilities CVE-2012-4558 Mod_proxy_balancer did not properly escape hostnames and ...
Several security issues were fixed in the Apache HTTP Server ...
Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancerc in the mod_proxy_balancer module in the Apache HTTP Server 22x before 2224-dev and 24x before 244 allow remote attackers to inject arbitrary web script or HTML via a crafted string Multiple cross-site scrip ...
Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancerc in the mod_proxy_balancer module in the Apache HTTP Server 22x before 2224-dev and 24x before 244 allow remote attackers to inject arbitrary web script or HTML via a crafted string Multiple cross-site scrip ...
Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's manager interface session (CVE-2012-4558) I ...
Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's manager interface session (CVE-2012-4558) I ...

Github Repositories

Scrape Linux CVE info pages

vuln-checker This is a simple Ruby CLI which scrapes security advisory pages and presents information on available fixes in a table Here's a text screenshot: % ruby -I lib bin/cve Showing information for: CVE-2012-3499 +--------------------+-----------------------------------------------------------+ | RHEL | accessredhatcom/security/cve/CVE-2012-3

A Web Pentest CheetSheet

Cheetsheet Pentest Reconocimiento Información básica Con herramientas como whatweb podemos hacer un reconocimiento inicial del sitio web para obtener información como la IP, el SO del servidor, en que país está este alojado o alguna vulnerabilidad básica, como XSS └─$ whatweb <URL> 3522724107/d6a05ac5cf/ [20

Forked and customised enum tool for pentesters.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

repository ini digunakan untuk belajar

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

Network reconnaissance and vulnerability assessment tools.

ReconScan The purpose of this project is to develop scripts that can be useful in the pentesting workflow, be it for VulnHub VMs, CTFs, hands-on certificates, or real-world targets The project currently consists of two major components: a script invoking and aggregating the results of existing tools, and a second script for automated analysis of the aforementioned results from

DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing. It was designed to be a challenge for beginners, but just how easy it is will depend on your skills and knowledge, and your ability to learn.

DC 1: Vulnhub Walkthrough DESCRIPTION: DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing It was designed to be a challenge for beginners, but just how easy it is will depend on your skills and knowledge, and your ability to learn To successfully complete this challenge, you will require Linux skills, familiarity

Fast IP Lookups for Open Ports and Vulnerabilities

internetdb Fast IP Lookups for Open Ports and Vulnerabilities Description Shodan shodanio/ scans the internet for hosts and services and maintains a few APIs into that data One API is the InternetDB internetdbshodanio/, which allows for free querying of open ports and vulnerabilities Tools are provided to query this servce What’s Inside The Tin The f

A python tool to quickly analyze all IPs and see which ones have open ports and vulnerabilities

Strike A python tool to quickly analyze all IPs and see which ones have open ports and vulnerabilities Installation apt-get install python3 git clone githubcom/SecureAxom/strike cd strike pip3 install -r requirementstxt python3 strikepy Usages python3 strikepy -h python3 strikepy -t 20891

Pigat:一款被动信息收集聚合工具 🚀 前言 Pigat(Passive Intelligence Gathering Aggregation Tool)被动信息收集聚合工具,该工具通过爬取目标URL在第三方网站比如备案查询网站、子域名查询网站的结果来对目标进行被动信息收集。 开发此工具的初衷就是平时在使用一些第三方的网站进行目标信息

Домашнее задание к занятию "Уязвимости и атаки на информационные системы" - Никулин Михаил Сергеевич Задание 1 ┌──(kali㉿kali)-[~] └─$ nmap -A --script vulnersnse 1921680169 Starting Nmap 793 ( nmaporg ) at 2023-04-10 13:43 EDT Nmap scan report for 192

Домашнее задание к занятию "131 «Уязвимости и атаки на информационные системы»" - Живарев Игорь Задание 1 Разрешённые сетевые службы: Обнаруженные уязвимости при агресивном сканировании: Обнаруж

whitehat nmap -sV --script vuln 192168123162 output Starting Nmap 793 ( nmaporg ) at 2022-12-25 15:11 EST Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 22400251 | After NULL UDP avahi packet DoS (CVE-2011-1002) |_ Hosts are all up (not vulnerable) Nmap scan report for 192168123162 Host is up (000025s latency) Not shown: 97

Домашнее задание к занятию 131 «Уязвимости и атаки на информационные системы» — Александр Гумлевой Задание 1 Скачайте и установите виртуальную машину Metasploitable: sourceforgenet/projects/metasploitable/ Это типовая

Задание 1 Скачайте и установите виртуальную машину Metasploitable: sourceforgenet/projects/metasploitable/ Это типовая ОС для экспериментов в области информационной безопасности, с которой следует начать при анализе уязвимост

Nmap-Scans-M2 Description This project is split into three repositories where this repository will provide the documentation of performing necessary Nmap scans to identify the vulnerabilities(CVEs) which are present in the targeted virtual machine The Kali Linux distro is utilized to perform the network scans Nmap is a powerful open source security auditing and network sca

References

CWE-79http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/util_ldap_cache_mgr.c?r1=1209766&r2=1418752&diff_format=hhttp://httpd.apache.org/security/vulnerabilities_22.htmlhttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1389564&r2=1413732&diff_format=hhttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_imagemap.c?r1=1398480&r2=1413732&diff_format=hhttp://httpd.apache.org/security/vulnerabilities_24.htmlhttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c?r1=1404625&r2=1413732&diff_format=hhttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_info.c?r1=1225799&r2=1413732&diff_format=hhttp://www.debian.org/security/2013/dsa-2637http://rhn.redhat.com/errata/RHSA-2013-0815.htmlhttp://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlhttp://support.apple.com/kb/HT5880http://rhn.redhat.com/errata/RHSA-2013-1208.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1209.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1207.htmlhttp://secunia.com/advisories/55032http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.htmlhttp://www.securityfocus.com/bid/64758http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://marc.info/?l=bugtraq&m=136612293908376&w=2http://www.securityfocus.com/bid/58165http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19312https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2013:0815https://github.com/mattfoster/vuln-checkerhttps://nvd.nist.govhttps://www.debian.org/security/./dsa-2637https://usn.ubuntu.com/1765-1/