72 matches found
Cherokee Web Server < 0.4.17.1 auth_pam Authentication Format String
Binary data 2383.prm...
Cherokee Web Server Error Page XSS
The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to cross-site scripting attacks due to lack of sanitization in returned error pages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Cherokee: Format string vulnerability
Background Cherokee is an extra-light web server. Description Florian Schilhabel from the Gentoo Linux Security Audit Team found a format string vulnerability in the cherokeeloggerncsawritestring function. Impact Using a specially crafted URL when authenticating via authpam, a malicious user may ...
Cherokee Web Server < 0.5.1 XSS
Binary data 3508.prm...
Format String in Cherokee
------------------------------------------------- No System Group - Advisory 3 - 17/04/04 ------------------------------------------------- Program: Cherokee Web Server Homepage: http://www.0x50.org Vulnerable Versions: Cherokee 0.4.16 and prior Risk: Low / Medium Impact: Local Format String...
CVE-2004-1946
Format string vulnerability in the PRINTERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument. NOTE: it is not clear whether this issue could be exploited remotely, or if...
CVE-2003-1198
connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field...
Cherokee Web Server does not adequately validate user input thereby allowing directory traversal
Overview Cherokee contains a directory traversal vulnerability caused by failure to filter '../' character sequences. Description Cherokee is a compact, open-source web server. Cherokee does not filter '../' sequences from HTTP requests. As a result, it is possible for a remote attacker to reques...
Cherokee Web Server does not adequately validate user input thereby allowing remote command execution
Overview Cherokee does not properly validate HTTP requests. Attackers may exploit this vulnerability to execute arbitrary commands as root. Description Cherokee is a compact, open-source web server. Cherokee passes Uniform Resource Identifiers URI's from HTTP requests directly to the shell withou...
Cherokee Web Server fails to drop privileges after daemon starts
Overview Cherokee fails to drop root privileges after binding to port 80. Description Cherokee is a compact, open-source web server. Cherokee is designed to start as root and drop root privileges after binding to port 80. However, versions of Cherokee prior to 0.2.7 fail to drop root privileges...