Unfixed XSS vulnerability at www.alma.edu

Security researcher cherokee warrior, has submitted on 17/06/2008 a cross-site-scripting XSS vulnerability affecting www.alma.edu, which at the time of submission ranked 289639 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/06/2008. It is...

Unfixed XSS vulnerability at lib11.library.vanderbilt.edu

Security researcher cherokee warrior, has submitted on 13/06/2008 a cross-site-scripting XSS vulnerability affecting lib11.library.vanderbilt.edu, which at the time of submission ranked 10695 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

Unfixed XSS vulnerability at www.jfklibrary.org

Security researcher cherokee warrior, has submitted on 13/06/2008 a cross-site-scripting XSS vulnerability affecting www.jfklibrary.org, which at the time of submission ranked 145829 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/06/2008. I...

Unfixed XSS vulnerability at digitalgallery.nypl.org

Security researcher cherokee warrior, has submitted on 17/04/2008 a cross-site-scripting XSS vulnerability affecting digitalgallery.nypl.org, which at the time of submission ranked 16776 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/04/200...

CVE-2006-1681

Cross-site scripting XSS vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated...

CVE-2006-1681

CVE-2006-1681 affects Cherokee HTTPD 0.5 and earlier. A cross-site scripting vulnerability exists where a malformed request that leads to an HTTP 400 error is not properly handled in the error message, allowing remote attackers to inject arbitrary script/HTML into a victim’s browser. Impact descr...

CVE-2006-1681

Cross-site scripting XSS vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated...

Cherokee web server crossite scripting

Crossite scripting on error message...

XSS Bug in Cherokee Webserver

Tuesday 4 of April of 2006, I have detected that it is possible to mount an attack of the type Cross Site Scripting XSS in cherokee-0.5.0 and all previous versions. The problem resides, when introducing code HTML in the URL. Because previously, it was let now of a seemed failure, from version 0.4...

Cross-Site Scripting in Cherokee Error Pages

The remote web server is vulnerable to a cross-site scripting issue. The remote host is running Cherokee - a fast and tiny web server. Due to a lack of sanitization from the user input, The remote version of this software is vulnerable to cross-site scripting attacks due to lack of sanitization i...

Cherokee POST request DoS

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to remote denial of service vulnerability when handling a specially-crafted HTTP 'POST' request. An attacker may exploit this flaw to disable this service remotely. OpenVAS...

Cherokee directory traversal flaw

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to directory traversal flaw when appending a '../' sequence to the web request. Additionally, this version fails to drop root privileges after it binds to listen port. Remote attack...

Cherokee directory traversal flaw

The remote version of Cherokee is vulnerable to directory traversal flaw when appending a SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cross-Site Scripting in Cherokee Error Pages

The remote Cherokee web server is vulnerable to a cross-site scripting issue due to lack of sanitization in returned error pages. SPDX-FileCopyrightText: 2004 David Maciejak SPDX-FileCopyrightText: Tenable Network Security Some text descriptions might be excerpted from a referenced sources, and a...

Cherokee remote command execution

The remote version of Cherokee is vulnerable to remote command execution due to a lack of web requests sanitization, especially shell metacharacters. Additionally, this version fails to drop root privileges after it binds to listen port. SPDX-FileCopyrightText: 2004 David Maciejak Some text...

Cherokee POST request DoS

The remote version of tCherokee is vulnerable to remote denial of service vulnerability when handling a specially-crafted HTTP SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Cherokee remote command execution

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to remote command execution due to a lack of web requests sanitization, especially shell metacharacters. Additionally, this version fails to drop root privileges after it binds to...

CVE-2004-2171

Cross-site scripting XSS vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page...

CVE-2004-2171

CVE-2004-2171 concerns the Cherokee web server. Multiple sources confirm a cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 , exploitable via the URL due to improper quoting in error pages. Affected software is Cherokee (pre-0.4.8); impact is ability for remote attackers to injec...

CVE-2004-1946

Format string vulnerability in the PRINT_ERROR function of Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument. The initial description notes it is unclear whether the issue could be exploited remotely or...