In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 49.5%.
Denial Of Service
Apache
Http Server
Debian Linux
Mac Os X
+13
NVD
CVSS 3.0
9.1
EPSS
49.5%
IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM
Information Disclosure
Bigfix Inventory
License Metric Tool
NVD
CVSS 3.0
9.8
EPSS
2.4%