cherokee-project records
9 published records for vendor cherokee-project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-787 Out-of-bounds Write2
- CWE-20 Improper Input Validation1
- CWE-287 Improper Authentication1
- CWE-310 Cryptographic Issues1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-476 NULL Pointer Dereference1
The weakness classes this vendor ships most often: where to look.
CWEAll records
9 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2019-20800No exploit | In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by secherokee-project · cherokee · CWE-787 | Critical9.8 | — | 2.1% | May 17, 2020 |
33Monitor | CVE-2019-20798No exploit | An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104.cherokee-project · cherokee · CWE-79 | High8.4 | — | 1.6% | May 17, 2020 |
31Monitor | CVE-2020-12845No exploit | Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences.cherokee-project · cherokee · CWE-476 | High7.5 | — | 3.2% | Jul 27, 2020 |
31Monitor | CVE-2019-20799No exploit | In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.cherokee-project · cherokee · CWE-787 | High7.5 | — | 2.3% | May 17, 2020 |
30Monitor | CVE-2019-1010218No exploit | Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120.cherokee-project · cherokee web server · CWE-120 | High7.5 | — | 1.3% | Jul 22, 2019 |
28Monitor | CVE-2014-4668No exploit | The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly considefedoraproject · fedora · CWE-287 | Medium6.8 | — | 2.8% | Jul 2, 2014 |
27Monitor | CVE-2011-2191No exploit | Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authenticacherokee-project · cherokee · CWE-352 | Medium6.8 | — | 1.3% | Oct 6, 2011 |
23Monitor | CVE-2009-4489Proof of concept | header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackercherokee-project · cherokee · CWE-20 | Medium5.0 | — | 9.8% | Jan 13, 2010 |
8Monitor | CVE-2011-2190No exploit | The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makecherokee-project · cherokee · CWE-310 | Low2.1 | — | 0.3% | Oct 6, 2011 |
- CVE-2019-2080040Plan
In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by se
CriticalCVSS 9.8No exploitEPSS 2%cherokee-project · cherokeeMay 17, 2020
- CVE-2019-2079833Monitor
An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104.
HighCVSS 8.4No exploitEPSS 1%cherokee-project · cherokeeMay 17, 2020
- CVE-2020-1284531Monitor
Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences.
HighCVSS 7.5No exploitEPSS 3%cherokee-project · cherokeeJul 27, 2020
- CVE-2019-2079931Monitor
In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.
HighCVSS 7.5No exploitEPSS 2%cherokee-project · cherokeeMay 17, 2020
- CVE-2019-101021830Monitor
Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120.
HighCVSS 7.5No exploitEPSS 1%cherokee-project · cherokee web serverJul 22, 2019
- CVE-2014-466828Monitor
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly conside
MediumCVSS 6.8No exploitEPSS 2%fedoraproject · fedoraJul 2, 2014
- CVE-2011-219127Monitor
Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentica
MediumCVSS 6.8No exploitEPSS 1%cherokee-project · cherokeeOct 6, 2011
- CVE-2009-448923Monitor
header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attacker
MediumCVSS 5.0Proof of conceptEPSS 9%cherokee-project · cherokeeJan 13, 2010
- CVE-2011-21908Monitor
The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which make
LowCVSS 2.1No exploitEPSS 0%cherokee-project · cherokeeOct 6, 2011