CVE-2004-1097: Undefined Security Weakness

Format string vulnerability in the cherokeeloggerncsawritestring function in Cherokee 0.4.17 and earlier, when authenticating via authpam, allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via format string specifiers in the URL...

Cherokee Web Server Malformed POST Request Remote DoS

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is affected by a remote denial of service vulnerability when handling a specially crafted HTTP 'POST' request. An attacker may exploit this flaw to disable this service remotely. C Tenable Networ...

Cherokee Web Server Port Bind Privilege Drop Weakness

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to remote command execution due to a lack of web requests sanitization, especially shell metacharacters. Additionally, this version fails to drop root privileges after it binds to...

Cherokee Web Server URI Traversal Arbitrary File Access

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to directory traversal flaw when appending a '../' sequence to the web request. Additionally, this version fails to drop root privileges after it binds to listen port. Remote attack...

Cherokee Web Server < 0.4.17.1 auth_pam Authentication Format String

Binary data 2383.prm...

Cherokee Web Server auth_pam Authentication Format String

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to a format string attack when processing authentication requests using authpam. This could allow a remote attacker to cause a denial of service, or potentially execute arbitrary...

Cherokee Web Server Error Page XSS

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to cross-site scripting attacks due to lack of sanitization in returned error pages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

[ GLSA 200411-02 ] Cherokee: Format string vulnerability

Gentoo Linux Security Advisory GLSA 200411-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Cherokee formatstring bug

Format string bug on syslog call and gile logging in NCSA format, cherokeeloggerncsawritestring...

GLSA-200411-02 : Cherokee: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200411-02 Cherokee: Format string vulnerability Florian Schilhabel from the Gentoo Linux Security Audit Team found a format string vulnerability in the cherokeeloggerncsawritestring function. Impact : Using a specially crafted URL...

Cherokee: Format string vulnerability

Background Cherokee is an extra-light web server. Description Florian Schilhabel from the Gentoo Linux Security Audit Team found a format string vulnerability in the cherokeeloggerncsawritestring function. Impact Using a specially crafted URL when authenticating via authpam, a malicious user may ...

Cherokee Web Server < 0.5.1 XSS

Binary data 3508.prm...

Format String in Cherokee

------------------------------------------------- No System Group - Advisory 3 - 17/04/04 ------------------------------------------------- Program: Cherokee Web Server Homepage: http://www.0x50.org Vulnerable Versions: Cherokee 0.4.16 and prior Risk: Low / Medium Impact: Local Format String...

CVE-2004-1946

Format string vulnerability in the PRINTERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument. NOTE: it is not clear whether this issue could be exploited remotely, or if...

Cherokee 0.1.x0.2.x0.4.x - Error Page Cross-Site Scripting

Cherokee 0.1.x0.2.x0.4.x - Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/9496/info Cherokee has been reported to contain a cross-site scripting vulnerability via error pages. An attacker can exploit this issue by crafting a URI link containing the malevolent HTML or...

Cherokee 0.1.x/0.2.x/0.4.x - Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/9496/info Cherokee has been reported to contain a cross-site scripting vulnerability via error pages. An attacker can exploit this issue by crafting a URI link containing the malevolent HTML or script code, and enticing a user to follow it. The...

CVE-2003-1198

connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field...

Cherokee Web Server fails to drop privileges after daemon starts

Overview Cherokee fails to drop root privileges after binding to port 80. Description Cherokee is a compact, open-source web server. Cherokee is designed to start as root and drop root privileges after binding to port 80. However, versions of Cherokee prior to 0.2.7 fail to drop root privileges...

Cherokee Web Server does not adequately validate user input thereby allowing remote command execution

Overview Cherokee does not properly validate HTTP requests. Attackers may exploit this vulnerability to execute arbitrary commands as root. Description Cherokee is a compact, open-source web server. Cherokee passes Uniform Resource Identifiers URI's from HTTP requests directly to the shell withou...

Cherokee Web Server does not adequately validate user input thereby allowing directory traversal

Overview Cherokee contains a directory traversal vulnerability caused by failure to filter '../' character sequences. Description Cherokee is a compact, open-source web server. Cherokee does not filter '../' sequences from HTTP requests. As a result, it is possible for a remote attacker to reques...