The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade httpdUpgrade httpd-develUpgrade mod_sslUpgrade httpd-toolsUpgrade httpd-manual | Dec 1, 2016 | Jan 24, 2008 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jan 25, 2008 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 1, 2015 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Jan 24, 2008 |
| Oracle_linux | — | Upgrade httpd-develUpgrade httpdUpgrade mod_sslUpgrade httpd-manualUpgrade httpd-tools | Oct 16, 2024 | Jan 25, 2008 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 13, 2012 |
| Suse | — | Upgrade apache2-workerUpgrade apache2-utilsUpgrade apache2Upgrade apache2-docUpgrade apache2-preforkUpgrade apache2-example-pages | Dec 12, 2013 | Jan 24, 2008 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub