CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3949
https://notcve.org/view.php?id=CVE-2007-3949
24 Jul 2007 — mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings. mod_access.c en lighttpd 1.4.15 ignora los caracteres / barra invertida (slash) en la URL, lo cual permite a atacantes remotos evitar configuraciones de url.access-deny. • http://osvdb.org/38311 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2007-3950
https://notcve.org/view.php?id=CVE-2007-3950
24 Jul 2007 — lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) mod_scgi, (2) mod_fastcgi, and (3) mod_webdav modules. lighttpd 1.4.15, cuando funciona bajo plataformas de 32 bits, permite a atacantes remotos provocar denegación de servicio (caida de demonio) a través de vectores no especificados afectando al uso de especificaciones de format... • http://secunia.com/advisories/26130 •
CVSS: 7.8EPSS: 1%CPEs: 30EXPL: 0CVE-2007-1870
https://notcve.org/view.php?id=CVE-2007-1870
18 Apr 2007 — lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference. lighttpd anterior a 1.4.14 permite a atacantes provocar una denegación de servicio (caída) mediante una petición a un fichero cuyo mtime es 0, lo cual resulta en una referencia a puntero nulo. • http://secunia.com/advisories/24886 •
CVSS: 9.1EPSS: 0%CPEs: 49EXPL: 0CVE-2006-0814
https://notcve.org/view.php?id=CVE-2006-0814
06 Mar 2006 — response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. response.c en Lighttpd 1.4.10 y posiblemente versiones anteriores, cuando se ejecuta sobre Windows, permite a atacantes leer código fuente de su elección mediante peticiones conteniendo caractéres (1) "." (punto) y (2) espacio al final, que... • http://secunia.com/advisories/18886 •
CVSS: 7.5EPSS: 0%CPEs: 47EXPL: 0CVE-2006-0760
https://notcve.org/view.php?id=CVE-2006-0760
18 Feb 2006 — LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names. • http://lighttpd.net/news •