lighttpd to 1.4.35 (important)

lighttpd was updated to version 1.4.35, fixing bugs and security issues: CVE-2014-2323: SQL injection vulnerability in modmysqlvhost.c in lighttpd allowed remote attackers to execute arbitrary SQL commands via the host name, related to requestcheckhostname. CVE-2014-2323: Multiple directory...

Khan Academy: Lighttpd version disclosure / directory listing

Hello there, the website at http://graphite.khanacademy.org/ isn't configured correctly. It displays the lighttpd version as well the directory contents. You should disable these features in your lighttpd.conf / php.ini. PoC: Index of / Name Last Modified Size Type Parent Directory/ - Directory...

lighttpd拒绝服务漏洞

Bugtraq ID:66599 CVE ID:CVE-2014-2469 lighttpd是一款HTTP服务程序。 lighttpd存在一个未明错误，允许远程攻击者利用漏洞提交恶意请求使服务程序崩溃。 0 lighttpd 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://blogs.oracle.com/sunsecurity/entry/cve20142469denialof...

Lighttpd Host Header mod_mysql_vhost SQL Injection (CVE-2014-2323)

A SQL injection vulnerability has been reported in Lighttpd Web Server. The vulnerability is due to insufficient sanitization of user supplied input in the Host header field of a request. A remote attacker could exploit this vulnerability by placing specially crafted data in the Host header field...

SuSE Update for lighttpd openSUSE-SU-2014:0449-1 (lighttpd)

Check for the Version of lighttpd OpenVAS Vulnerability Test $Id: gbsuse201404491.nasl 8044 2017-12-08 08:32:49Z santu $ SuSE Update for lighttpd openSUSE-SU-2014:0449-1 lighttpd Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This...

Fedora Update for lighttpd FEDORA-2014-3947

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for lighttpd FEDORA-2014-3887

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for lighttpd (openSUSE-SU-2014:0449-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for lighttpd FEDORA-2014-3947

Check for the Version of lighttpd OpenVAS Vulnerability Test Fedora Update for lighttpd FEDORA-2014-3947 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for lighttpd FEDORA-2014-3887

Check for the Version of lighttpd OpenVAS Vulnerability Test Fedora Update for lighttpd FEDORA-2014-3887 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

lighttpd 'mod_mysql_vhost.c' SQL注入漏洞

BUGTRAQ ID: 66153 CVECAN ID: CVE-2014-2323 Lighttpd是一款轻型的开放源码Web Server软件包。 由于程序在进行SQL查询前未能充分过滤用户提供的输入，攻击者可以利用漏洞危及应用程序，访问或修改数据，或利用底层数据库中潜在的漏洞。 0 lighttpd 1.4.35 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.lighttpd.net...

lighttpd to 1.4.35 (important)

lighttpd was updated to version 1.4.35, fixing bugs and security issues: CVE-2014-2323: SQL injection vulnerability in modmysqlvhost.c in lighttpd allowed remote attackers to execute arbitrary SQL commands via the host name, related to requestcheckhostname. CVE-2014-2323: Multiple directory...

Fedora 19 : lighttpd-1.4.35-1.fc19 (2014-3947)

1.4.35, fixes SA-2014-01, CVE-2014-2323, CVE-2014-2324 1 http://seclists.org/oss-sec/2014/q1/561 2 http://download.lighttpd.net/lighttpd/security/lighttpdsa201401.txt 3 http://www.lighttpd.net/2014/3/12/1.4.35/ Note that Tenable Network Security has extracted the preceding description block...

Fedora 20 : lighttpd-1.4.35-1.fc20 (2014-3887)

1.4.35, fixes SA-2014-01, CVE-2014-2323, CVE-2014-2324 1 http://seclists.org/oss-sec/2014/q1/561 2 http://download.lighttpd.net/lighttpd/security/lighttpdsa201401.txt 3 http://www.lighttpd.net/2014/3/12/1.4.35/ Note that Tenable Network Security has extracted the preceding description block...

[SECURITY] Fedora 20 Update: lighttpd-1.4.35-1.fc20

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

[SECURITY] Fedora 19 Update: lighttpd-1.4.35-1.fc19

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

lighttpd security vulnerabilities

SQL injection, directory traversal...

[SECURITY] [DSA 2877-1] lighttpd security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2877-1 [email protected] http://www.debian.org/security/ Michael Gilbert March 12, 2014 http://www.debian.org/security/faq -...

lighttpd < 1.4.35 Multiple Vulnerabilities

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.35. It is, therefore, affected by the following vulnerabilities : - A SQL injection flaw exists in the 'modmysqlvhost' module where user input passed using the hostname is not properly sanitized. A remote...

Updated lighttpd package fixes security vulnerabilities

SQL injection vulnerability in lighttpd before 1.4.35 when modmysqlvhost is in use, due to insufficient validation of hostnames in HTTP requests CVE-2014-2323. Possible path traversal vulnerabilities in lighttpd before 1.4.35 when either modevhost or modsimplevhost are in use, due to insufficient...