Vendors / varnish-software Records 18 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 10
Exploited now varnish-software records in CISA KEV No varnish-software vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 43
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 conn…
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02011 · Published 2022-01-26 · Fixed CWE-444
Priority MEDIUM 42
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.059 · Published 2019-09-03 · Fixed CWE-617
Priority MEDIUM 41
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01296 · Published 2022-11-09 · Fixed CWE-20
Priority LOW 37
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02159 · Published 2020-04-08 · Partial fix CWE-617
Priority LOW 37
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02416 · Published 2017-08-04 · Will not fix CWE-190
Priority LOW 36
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0179 · Published 2020-04-08 · Partial fix CWE-212
Priority LOW 32
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01599 · Published 2021-07-14 · Fixed CWE-444
Open these records in search → All records by CVSS severity
2 10 4 2 0
THREATIST.IORead the docs