The vulnerability of the Lighttpd web server, related to integer overflows, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Lighttpd web server is related to a potential integer overflow. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions through malicious GET requests...

FIBARO System Home Center 5.021 - Remote File Include

Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Date: 2020-03-22 Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center 2, Home Center Lite 5.021.38 4.580 4.570...

CVE-2019-5149

The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs...

Default configuration

The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs...

CVE-2019-5149

The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs...

WAGO PFC100/200 Web-Based Management (WBM) Authentication Timing Information Disclosure Vulnerability

Summary An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management WBM web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt function which can be exploited to disclose hashed user credentials...

WAGO PFC100/200 Web-Based Management (WBM) FastCGI configuration insufficient resource pool denial of service

Summary The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to “provide high performance for all Internet applications without the penalties of Web...

Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Fifthplay S.A.M.I 2019.2HP - Persistent Cross-Site Scripting Exploit Author: LiquidWorm Vendor: Fifthplay NV Vendor Homepage: https://www.fifthplay.com Version: 2019.2HP Tested on: Linux CVE : - Fifthplay S.A.M.I - Service...

CVE-2013-3619

Intelligent Platform Management Interface IPMI with firmware for Supermicro X9 generation motherboards before SMTX9317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the 1 Lighttpd web server SSL interface and the 2 Dropbear S...

Design/Logic Flaw

Intelligent Platform Management Interface IPMI with firmware for Supermicro X9 generation motherboards before SMTX9317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the 1 Lighttpd web server SSL interface and the 2 Dropbear S...

CVE-2013-3619

Intelligent Platform Management Interface IPMI with firmware for Supermicro X9 generation motherboards before SMTX9317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the 1 Lighttpd web server SSL interface and the 2 Dropbear S...

CVE-2013-3619

CVE-2013-3619 affects Supermicro IPMI firmware on X9 generation (before SMT_X9_317) and X8 generation (before SMT_X8_312). The root cause is hardcoded private encryption keys used by the Lighttpd SSL interface and the Dropbear SSH daemon within the IPMI firmware, enabling potential impersonation,...

Lighttpd Web Server Denial Of Service (CVE-2019-11072)

A denial-of-service vulnerability exists in Lighttpd server. This vulnerability is due to improper handling of URL when url-path-2f-decode is enabled. A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the target server. Successful...

Linear eMerge E3 1.00-06 card_scan_decoder.php Command Injection

!/usr/bin/env python Linear eMerge E3 Unauthenticated Command Injection Remote Root Exploit Affected version: =1.00-06 via cardscandecoder.php CVE: CVE-2019-7256 Advisory: https://applied-risk.com/resources/ar-2019-005 Paper: https://applied-risk.com/resources/i-own-your-building-management-syste...

Linear eMerge E3 Access Controller Command Injection

Nortek Linear eMerge E3 Unauthenticated Remote Root Code Execution Metasploit by Gjoko 'LiquidWorm' Krstic Affected version: 'Linear eMerge E3 Access Controller Command Injection', 'Description' = %q This module exploits a command injection vulnerability in the Linear eMerge E3 Access Controller...

Linear eMerge E3 1.00-06 card_scan.php Command Injection

!/usr/bin/env python Linear eMerge E3 Unauthenticated Command Injection Remote Root Exploit Affected version: \n' sys.exit ipaddr = sys.argv1 print while True: try: cmd = rawinput'lighttpd@'+ipaddr+':/spider/web/webroot$ ' execute =...

openSUSE: Security Advisory for lighttpd (openSUSE-SU-2019:2347-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : lighttpd (openSUSE-2019-2347)

This update for lighttpd to version 1.4.54 fixes the following issues : Security issues fixed : - CVE-2018-19052: Fixed a path traversal in modalias boo1115016. - Changed the default TLS configuration of lighttpd for better security out-of-the-box boo1087369. C Tenable Network Security, Inc. The...

OPENSUSE-SU-2019:2347-1 Security update for lighttpd

This update for lighttpd to version 1.4.54 fixes the following issues: Security issues fixed: - CVE-2018-19052: Fixed a path traversal in modalias boo1115016. - Changed the default TLS configuration of lighttpd for better security out-of-the-box boo1087369...

Security update for lighttpd (moderate)

openSUSE Security Update: Security update for lighttpd Announcement ID: openSUSE-SU-2019:2347-1 Rating: moderate References: 1087369 1111733 1115016 1153722 Cross-References: CVE-2018-19052 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports...