İçeriğe atla
Noroxi

lighttpd kayıtları

lighttpd üreticisine ait 36 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
2
Düzeltme kaydı olan
%88,9
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 18
  2. 19
  3. 22
  4. 24
  5. 25

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

36 kayıt
  • CVE-2019-11072
    61Bu hafta

    lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or

    KritikCVSS 9,8İstismar yokEPSS %74

    lighttpd · lighttpd10 Nis 2019

  • CVE-2014-2323
    58Planlayın

    SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the

    KritikCVSS 9,8Kavram kanıtıEPSS %63

    lighttpd · lighttpd14 Mar 2014

  • CVE-2022-30780
    47Planlayın

    Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connec

    YüksekCVSS 7,5Kavram kanıtıEPSS %57

    lighttpd · lighttpd11 Haz 2022

  • CVE-2018-19052
    34İzleyin

    An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50.

    YüksekCVSS 7,5Kavram kanıtıEPSS %14

    lighttpd · lighttpd7 Kas 2018

  • CVE-2007-3949
    34İzleyin

    mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny se

    YüksekCVSS 8,3İstismar yokEPSS %3

    lighttpd · lighttpd23 Tem 2007

  • CVE-2013-4559
    33İzleyin

    lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd

    YüksekCVSS 7,6İstismar yokEPSS %11

    lighttpd · lighttpd20 Kas 2013

  • CVE-2015-3200
    33İzleyin

    mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a

    YüksekCVSS 7,5İstismar yokEPSS %10

    lighttpd · lighttpd9 Haz 2015

  • CVE-2007-1870
    32İzleyin

    lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NU

    YüksekCVSS 7,8İstismar yokEPSS %3

    lighttpd · lighttpd17 Nis 2007

  • CVE-2007-4727
    31İzleyin

    Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows re

    OrtaCVSS 6,8İstismar yokEPSS %13

    lighttpd · lighttpd12 Eyl 2007

  • CVE-2008-4359
    31İzleyin

    lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL de

    YüksekCVSS 7,5İstismar yokEPSS %4

    lighttpd · lighttpd3 Eki 2008

  • CVE-2008-4360
    31İzleyin

    mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons o

    YüksekCVSS 7,5İstismar yokEPSS %4

    lighttpd · lighttpd3 Eki 2008

  • CVE-2022-41556
    31İzleyin

    A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a lar

    YüksekCVSS 7,5İstismar yokEPSS %3

    lighttpd · lighttpd6 Eki 2022

  • CVE-2013-4508
    31İzleyin

    lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by i

    YüksekCVSS 7,5İstismar yokEPSS %3

    lighttpd · lighttpd8 Kas 2013

  • CVE-2022-37797
    31İzleyin

    In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received

    YüksekCVSS 7,5İstismar yokEPSS %3

    lighttpd · lighttpd12 Eyl 2022

  • CVE-2014-2324
    29İzleyin

    Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to

    OrtaCVSS 5,0Kavram kanıtıEPSS %29

    lighttpd · lighttpd14 Mar 2014

  • CVE-2025-12642
    27İzleyin

    HTTP Header Smuggling via Trailer Merge

    OrtaCVSS 6,9İstismar yokEPSS %0

    lighttpd · lighttpd3 Kas 2025

  • CVE-2011-4362
    26İzleyin

    Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30

    OrtaCVSS 5,0Kavram kanıtıEPSS %21

    lighttpd · lighttpd24 Ara 2011

  • CVE-2022-22707
    26İzleyin

    In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 b

    OrtaCVSS 5,9İstismar yokEPSS %9

    lighttpd · lighttpd6 Oca 2022

  • CVE-2007-3946
    26İzleyin

    mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors

    OrtaCVSS 6,4İstismar yokEPSS %3

    lighttpd · lighttpd23 Tem 2007

  • CVE-2007-3947
    25İzleyin

    request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate h

    OrtaCVSS 5,8Kavram kanıtıEPSS %8

    lighttpd · lighttpd23 Tem 2007

  • CVE-2010-0295
    24İzleyin

    lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to ca

    OrtaCVSS 5,0Kavram kanıtıEPSS %12

    lighttpd · lighttpd3 Şub 2010

  • CVE-2012-5533
    24İzleyin

    The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite

    OrtaCVSS 5,0Kavram kanıtıEPSS %12

    lighttpd · lighttpd24 Kas 2012

  • CVE-2008-1270
    24İzleyin

    mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to rea

    OrtaCVSS 5,0Kavram kanıtıEPSS %12

    lighttpd · lighttpd10 Mar 2008

  • CVE-2006-0814
    23İzleyin

    response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via

    OrtaCVSS 5,0İstismar yokEPSS %11

    lighttpd · lighttpd6 Mar 2006

  • CVE-2013-4560
    22İzleyin

    Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) v

    OrtaCVSS 5,0İstismar yokEPSS %5

    lighttpd · lighttpd20 Kas 2013