The vulnerability of the Yaws CGI web server lies in the lack of measures to neutralize special elements, which allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Yaws CGI web server implementation is related to improper cleaning of CGI requests. Exploiting this vulnerability can allow an attacker who operates remotely to access confidential data, compromise its integrity, and cause service failures...

Debian DSA-4773-1 : yaws - security update

Two vulnerabilities were discovered in yaws, a high performance HTTP 1.1 webserver written in Erlang. - CVE-2020-24379 The WebDAV implementation is prone to a XML External Entity XXE injection vulnerability. - CVE-2020-24916 The CGI implementation does not properly sanitize CGI requests allowing ...

Debian: Security Advisory (DSA-4773-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4773-1] yaws security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4773-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 16, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4773-1] yaws security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4773-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 16, 2020 https://www.debian.org/security/faq -...

DSA-4773-1 yaws - security update

Bulletin has no description...

Ubuntu: Security Advisory (USN-4569-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4569-1: Yaws vulnerabilities

It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE injection attack. CVE-2020-24379 It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use this...

USN-4569-1 yaws vulnerabilities

It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE injection attack. CVE-2020-24379 It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use this...

Ubuntu 18.04 LTS : Yaws vulnerabilities (USN-4569-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4569-1 advisory. It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE...

Debian DLA-2384-1 : yaws security update

Two issues have been found in yaws, a high performance HTTP 1.1 webserver written in Erlang. CVE-2020-24379 Reject external resource requests in DAV in order to avoid XML External Entity XXE attackes. CVE-2020-24916 Sanitize CGI executable in order to avoid command injection via CGI requests. For...

Debian: Security Advisory (DLA-2384-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2384-1] yaws security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2384-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz September 26, 2020 https://wiki.debian.org/LTS -...

DLA-2384-1 yaws - security update

Bulletin has no description...

[ASA-202009-14] yaws: multiple issues

Arch Linux Security Advisory ASA-202009-14 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916 Package : yaws Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1228 Summary ======= The packag...

CVE-2020-24916

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...

CVE-2020-24379

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...

DEBIAN-CVE-2020-24916

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...

CVE-2020-24916

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...

CVE-2020-24379

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...