Description
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
Remediation
References
Related Vulnerabilities
WordPress Plugin Simple File Downloader Cross-Site Scripting (1.0.4)
WordPress 5.3.x PHP Object Injection (5.3 - 5.3.7)
WordPress Plugin Appointment Calendar Multiple Cross-Site Scripting Vulnerabilities (2.7.4)
PHP Other Vulnerability (CVE-2006-1608)
ATutor Incorrect Authorization Vulnerability (CVE-2019-16114)