Vendors / Varnish-cache Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 4
Exploited now Varnish-cache records in CISA KEV No Varnish-cache vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 46
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer…
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.04084 · Published 2017-11-16 · No fix listed CWE-119
Priority LOW 37
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02159 · Published 2020-04-08 · Partial fix CWE-617
Priority LOW 37
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02416 · Published 2017-08-04 · Will not fix CWE-190
Priority LOW 36
Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01495 · Published 2021-03-16 · No fix listed CWE-476
Priority LOW 36
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0179 · Published 2020-04-08 · Partial fix CWE-212
Priority LOW 32
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01599 · Published 2021-07-14 · Fixed CWE-444
Priority LOW 29
Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
CVSS 2.0 MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03236 · Published 2013-11-01 · No fix listed CWE-119
Open these records in search → All records by CVSS severity
1 4 2 0 0
THREATIST.IORead the docs