cajjassociates.com (64.227.179.164)

India · Bengaluru

Risk score: 98/100 · 2 open port(s) · 101 CVE(s)

First seen 2026-08-18 · last seen 2026-08-18

Open ports

Port	Service	Software	CVEs
22	ssh	OpenSSH	23
443	http	Apache HTTP Server	78

CVEs (101)

• CVE-2020-14145 medium · CVSS 5.9 — The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This a
• CVE-2021-28041 high · CVSS 7.1 — ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket ac
• CVE-2016-20012 medium · CVSS 5.3 — OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH s
• CVE-2021-41617 high · CVSS 7.0 — sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplement
• CVE-2021-36368 low · CVSS 3.7 — An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=v
• CVE-2023-38408 critical · CVSS 9.8 — The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
• CVE-2023-48795 medium · CVSS 5.9 — The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas
• CVE-2023-51385 medium · CVSS 6.5 — In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is refere
• CVE-2023-51767 high · CVSS 7.0 — OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer val
• CVE-2025-26465 medium · CVSS 6.8 — A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malic
• CVE-2025-32728 medium · CVSS 4.3 — In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent
• CVE-2026-35385 high · CVSS 7.5 — In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the
• CVE-2026-35387 low · CVSS 3.1 — OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgo
• CVE-2026-35388 low · CVSS 2.5 — OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
• CVE-2026-35414 medium · CVSS 4.2 — OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a
• CVE-2026-59995 medium · CVSS 4.2 — sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker
• CVE-2026-59996 medium · CVSS 4.2 — scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destina
• CVE-2026-59997 medium · CVSS 4.2 — internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-l
• CVE-2026-59998 medium · CVSS 4.8 — sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windo
• CVE-2026-59999 medium · CVSS 5.9 — In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
• CVE-2026-60000 low · CVSS 3.7 — sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempt
• CVE-2026-60001 medium · CVSS 6.5 — sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
• CVE-2026-60002 high · CVSS 7.7 — ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only
• CVE-2019-17567 medium · CVSS 5.3 — Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server wa
• CVE-2020-13938 medium · CVSS 5.5 — Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
• CVE-2020-13950 high · CVSS 7.5 — Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests
• CVE-2020-35452 high · CVSS 7.3 — Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no repo
• CVE-2021-26690 high · CVSS 7.5 — Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference an
• CVE-2021-26691 critical · CVSS 9.8 — In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
• CVE-2021-30641 medium · CVSS 5.3 — Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
• CVE-2021-33193 high · CVSS 7.5 — A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache pois
• CVE-2021-34798 high · CVSS 7.5 — Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
• CVE-2021-36160 high · CVSS 7.5 — A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache
• CVE-2021-39275 critical · CVSS 9.8 — ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functio
• CVE-2021-40438 critical · CVSS 9.0 — A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apa
• CVE-2021-44224 high · CVSS 8.2 — A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurat
• CVE-2021-44790 critical · CVSS 9.8 — A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Ap
• CVE-2022-22719 high · CVSS 7.5 — A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache
• CVE-2022-22720 critical · CVSS 9.8 — Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing th
• CVE-2022-22721 critical · CVSS 9.1 — If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which
• CVE-2022-23943 critical · CVSS 9.8 — Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provid
• CVE-2022-26377 high · CVSS 7.5 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attac
• CVE-2022-28330 medium · CVSS 5.3 — Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
• CVE-2022-28614 medium · CVSS 5.3 — The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect
• CVE-2022-28615 critical · CVSS 9.1 — Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with
• CVE-2022-29404 high · CVSS 7.5 — In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to
• CVE-2022-30556 high · CVSS 7.5 — Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated
• CVE-2022-31813 critical · CVSS 9.8 — Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop
• CVE-2006-20001 high · CVSS 7.5 — A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the
• CVE-2022-36760 critical · CVSS 9.0 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attac
• …and 51 more (see the interactive dossier)

Services

View interactive dossier