CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2008-4359
https://notcve.org/view.php?id=CVE-2008-4359
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data. lighttpd versiones anteriores a v1.4.20 compara URIs con patrones en los ajustes de configuración (1) url.redirect y (2) url.rewrite antes de realizar la decodificación de URL, lo cual puede permitir a atacantes remotos evitar restricciones de acceso intencionado, y obtener información sensible o posiblemente modificar datos. • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html http://openwall.com/lists/oss-security/2008/09/30/1 http://openwall.com/lists/oss-security/2008/09/30/2 http://openwall.com/lists/oss-security/2008/09/30/3 http://secunia.com/advisories/32069 http://secunia.com/advisories/32132 http://secunia.com/advisories/32480 http://secunia.com/advisories/32834 http://secunia.com/advisories/32972 http://security.gentoo.org/glsa/glsa-200812-04.xml http& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 11%CPEs: 54EXPL: 0CVE-2008-4298
https://notcve.org/view.php?id=CVE-2008-4298
Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers. Fugas de memoria en la función http_request_parse en request.c en lighttpd anteriores a v1.4.20 permite a atacantes remotos causar denegación de servicio (corrupción de memoria) a través de un gran número de peticiones con cabeceras de peticiones duplicadas. • http://bugs.gentoo.org/show_bug.cgi?id=238180 http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html http://secunia.com/advisories/32069 http://secunia.com/advisories/32132 http://secunia.com/advisories/32480 http://secunia.com/advisories/32834 http://secunia.com/advisories/32972 http://security.gentoo.org/glsa/glsa-200812-04.xml http://trac.lighttpd.net/trac/changeset/2305 http://trac.lighttpd.net/trac/ticket/1774 http://wiki.rpath.com/Advisories:rPS • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 10%CPEs: 3EXPL: 0CVE-2008-1531
https://notcve.org/view.php?id=CVE-2008-1531
The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost. La función connection_state_machine (connections.c) en lighttpd versión 1.4.19 y anteriores, y versión 1.5.x anterior a 1.5.0, permite a los atacantes remotos generar una denegación de servicio (pérdida de conexión SSL activa) al activar un error SSL, como desconectarse antes que una descarga ha finalizado, lo que hace que todas las conexiones SSL activas se pierdan. • http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html http://secunia.com/advisories/29505 http://secunia.com/advisories/29544 http://secunia.com/advisories/29636 http://secunia.com/advisories/29649 http://secunia.com/advisories/30023 http://security.gentoo.org/glsa/glsa-200804-08.xml http://trac.lighttpd.net/trac/changeset/2136 http://trac.lighttpd.net/trac/changeset/2139 http://trac.lighttpd.net/trac/changeset/2140 http://trac.lighttpd.net/trac/ticket&#x •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 2CVE-2008-1270 – Lighttpd 1.4.x - mod_userdir Information Disclosure
https://notcve.org/view.php?id=CVE-2008-1270
mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. mod_userdir en lighttpd 1.4.18 y anteriores, cuando no está establecido el userdir.path usa un $HOME por defecto, que podría permitir a atacantes remotos leer ficheros de su elección como se ha demostrado accediendo al directorio ~nobody. • https://www.exploit-db.com/exploits/31396 http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html http://secunia.com/advisories/29318 http://secunia.com/advisories/29403 http://secunia.com/advisories/29622 http://secunia.com/advisories/29636 http://security.gentoo.org/glsa/glsa-200804-08.xml http://trac.lighttpd.net/trac/ticket/1587 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106 http://www.debian.org/security/2008/dsa-1521 http://www.lighttpd. • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1111
https://notcve.org/view.php?id=CVE-2008-1111
mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information. El mod_cgi en lighttpd versión 1.4.18, envía el código fuente de los scripts CGI en lugar de un error 500 cuando ocurre un fallo de bifurcación, lo que podría permitir a los atacantes remotos obtener información confidencial. • http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html http://secunia.com/advisories/29209 http://secunia.com/advisories/29235 http://secunia.com/advisories/29268 http://secunia.com/advisories/29275 http://secunia.com/advisories/29318 http://secunia.com/advisories/29622 http://security.gentoo.org/glsa/glsa-200803-10.xml http://trac.lighttpd.net/trac/changeset/2107 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106 http://www.debian.org/security/2008/d • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •