CVE-2019-0197

MEDIUM Year: 2019
CVSS v3 Score
4.2
Medium
CVSS v2 Score
4.9
Medium
Weakness Type
CWE-444
View all →

Vulnerability Description

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

Related Vulnerabilities

CVE-2020-5218

MEDIUM
CVSS:4.3(Medium)

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to ...

CWE-4442020

CVE-2021-32598

MEDIUM
CVSS:4.3(Medium)

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, ...

CWE-4442021

CVE-2023-49584

MEDIUM
CVSS:4.3(Medium)

SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing ...

CWE-4442023

CVE-2024-42342

MEDIUM
CVSS:4.3(Medium)

Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-4442024

CVE-2021-41136

LOW
CVSS:3.7(Low)

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP req...

CWE-4442021

CVE-2022-39163

MEDIUM
CVSS:4.7(Medium)

IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site...

CWE-4442022