CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
HTTP/2 Protocol Rapid Reset Distributed Denial of Service Vulnerability (CVE-2023-44487)
[Affected Scope] All web servers, reverse proxies, load balancers, and CDN architectures that have the HTTP/2 protocol enabled
[Impact] Attackers can cause a complete Denial of Service (DoS) by rapidly opening and immediately canceling (via RST_STREAM) a massive volume of HTTP/2 streams, exhausting server CPU and memory resources
[Mitigation] Immediately apply official security patches for your web servers (Nginx, Apache, IIS, etc.) and proxy devices, or restrict HTTP/2 concurrent streams and enforce strict rate limiting
PHP-FPM Remote Code Execution Vulnerability (CVE-2019-11043) Security Advisory and Mitigation Guide
[Affected Scope] PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 running in certain Nginx + PHP-FPM configurations
[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory write in the PHP-FPM process, leading to arbitrary remote code execution (RCE) on the target web server
[Mitigation] Immediately upgrade PHP to patched versions (7.1.33, 7.2.24, 7.3.11 or higher) and configure Nginx with 'try_files' to verify file existence before passing requests to FastCGI