Total
34 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2008-0983 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.0 MEDIUM | N/A |
| lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access. | |||||
| CVE-2008-1270 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.0 MEDIUM | N/A |
| mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. | |||||
| CVE-2007-3947 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.8 MEDIUM | N/A |
| request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault. | |||||
| CVE-2007-3948 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 4.3 MEDIUM | N/A |
| connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service (failed assertion) via a large number of connection attempts. | |||||
| CVE-2007-3950 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 4.3 MEDIUM | N/A |
| lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) mod_scgi, (2) mod_fastcgi, and (3) mod_webdav modules. | |||||
| CVE-2007-1870 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 7.8 HIGH | N/A |
| lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference. | |||||
| CVE-2008-1111 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.0 MEDIUM | N/A |
| mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information. | |||||
| CVE-2007-1869 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.0 MEDIUM | N/A |
| lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption. | |||||
| CVE-2007-3946 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 6.4 MEDIUM | N/A |
| mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header. | |||||
| CVE-2007-3949 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 8.3 HIGH | N/A |
| mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings. | |||||
| CVE-2007-4727 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 6.8 MEDIUM | N/A |
| Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow." | |||||
| CVE-2006-0814 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.0 MEDIUM | N/A |
| response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. | |||||
| CVE-2005-0453 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 5.0 MEDIUM | N/A |
| The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension. | |||||
| CVE-2006-0760 | 1 Lighttpd | 1 Lighttpd | 2023-12-10 | 2.6 LOW | N/A |
| LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names. | |||||