CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-44117
https://notcve.org/view.php?id=CVE-2022-44117
Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL. Boa 0.94.14rc21 es vulnerable a la inyección SQL mediante nombre de usuario. • https://gist.github.com/yinfei6/20bd1d3ebe0803c2d8756ace3e173676 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21028
https://notcve.org/view.php?id=CVE-2018-21028
Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function. Boa versiones hasta 0.94.14rc21, permite a atacantes remotos activar una pérdida de memoria debido a llamadas perdidas a la función free. • https://github.com/gpg/boa/pull/1 https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21027
https://notcve.org/view.php?id=CVE-2018-21027
Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled. Boa versiones hasta 0.94.14rc21, permite a atacantes remotos desencadenar una condición fuera de la memoria (OOM) porque malloc es manejada inapropiadamente. • https://github.com/gpg/boa/pull/1 https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 73%CPEs: 1EXPL: 3CVE-2017-9833 – BOA Web Server 0.94.14rc21 - Arbitrary File Access
https://notcve.org/view.php?id=CVE-2017-9833
/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable. /cgi-bin/wapopen in BOA Webserver 0.94.14rc21 permite la inyección de "../.." usando la variable FILECAMERA (enviada por GET) para leer archivos con privilegios root. BOA Web Server version 0.94.14rc21 an arbitrary file access vulnerability. • https://www.exploit-db.com/exploits/42290 https://github.com/anldori/CVE-2017-9833 https://pastebin.com/raw/rt7LJvyF • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •