1515 matches found
Code injection
lighttpd before 1.4.20 compares URIs to patterns in the 1 url.redirect and 2 url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data...
CVE-2008-4359
lighttpd before 1.4.20 compares URIs to patterns in the 1 url.redirect and 2 url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data...
CVE-2008-4360
moduserdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a...
CVE-2008-4359
CVE-2008-4359 affects lighttpd before 1.4.20. The vulnerability arises because URIs are compared against url.redirect/url.rewrite patterns prior to URL decoding, potentially bypassing access restrictions and allowing leakage of information or data modification. IBM’s IMM advisory confirms this CV...
CVE-2008-4360
Vulnerability summary (CVE-2008-4360) Lighttpd
CVE-2008-4359
lighttpd before 1.4.20 compares URIs to patterns in the 1 url.redirect and 2 url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data...
lighttpd < 1.4.20 Multiple Vulnerabilities
According to its banner, the version of lighttpd running on the remote host is prior to 1.4.20. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the connectionstatemachine function that is triggered when disconnecting before a download has...
FreeBSD Ports: lighttpd
The remote host is missing an update to the system as announced in the referenced advisory. VID fb911e31-8ceb-11dd-bb29-000c6e274733 OpenVAS Vulnerability Test $ Description: Auto generated from VID fb911e31-8ceb-11dd-bb29-000c6e274733 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
CVE-2008-4359: Exposure of Sensitive Information to an Unauthorized Actor
lighttpd before 1.4.20 compares URIs to patterns in the 1 url.redirect and 2 url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data...
FreeBSD Ports: lighttpd
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2008-4360: Exposure of Sensitive Information to an Unauthorized Actor
moduserdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a...
lighttpd < 1.4.20 Multiple Vulnerabilities
Binary data 4698.prm...
FreeBSD : lighttpd -- multiple vulnerabilities (fb911e31-8ceb-11dd-bb29-000c6e274733)
Lighttpd seurity announcement : lighttpd 1.4.19, and possibly other versions before 1.5.0, does not decode the url before matching against rewrite and redirect patterns, which allows attackers to bypass rewrites rules. this can be a security problem in certain configurations if these rules are us...
CVE-2008-4298
Memory leak in the httprequestparse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service memory consumption via a large number of requests with duplicate request headers...
CVE-2008-4298
Memory leak in the httprequestparse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service memory consumption via a large number of requests with duplicate request headers...
DEBIAN-CVE-2008-4298
Memory leak in the httprequestparse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service memory consumption via a large number of requests with duplicate request headers...
CVE-2008-4298
The connected documents confirm CVE-2008-4298 affects lighttpd: memory leak in http_request_parse() in request.c, exploitable by remote attackers to cause a denial of service via crafted requests with duplicate headers. Affected are lighttpd versions up to 1.4.19/1.4.20 (older IMM/OpenSUSE builds...
CVE-2008-4298: Undefined Security Weakness
Memory leak in the httprequestparse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service memory consumption via a large number of requests with duplicate request headers...
CVE-2008-4298
Memory leak in the httprequestparse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service memory consumption via a large number of requests with duplicate request headers...
CVE-2008-4298
Memory leak in the httprequestparse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service memory consumption via a large number of requests with duplicate request headers...