CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2022-45956
https://notcve.org/view.php?id=CVE-2022-45956
Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism. Las versiones 0.94.13 a 0.94.14 de Boa Web Server no validan la restricción de seguridad correcta en el método HEAD HTTP, lo que permite a todos omitir el mecanismo Basic Authorization. • https://packetstormsecurity.com/files/169962/Boa-Web-Server-0.94.13-0.94.14-Authentication-Bypass.html • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21028
https://notcve.org/view.php?id=CVE-2018-21028
Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function. Boa versiones hasta 0.94.14rc21, permite a atacantes remotos activar una pérdida de memoria debido a llamadas perdidas a la función free. • https://github.com/gpg/boa/pull/1 https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21027
https://notcve.org/view.php?id=CVE-2018-21027
Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled. Boa versiones hasta 0.94.14rc21, permite a atacantes remotos desencadenar una condición fuera de la memoria (OOM) porque malloc es manejada inapropiadamente. • https://github.com/gpg/boa/pull/1 https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 2CVE-2009-4496 – BOA Web Server 0.94.x - Terminal Escape Sequence in Logs Command Injection
https://notcve.org/view.php?id=CVE-2009-4496
Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Boa v0.94.14rc21, escribe datos en un archivo de los sin depurar los caracteres no escribibles, lo que podría permitir a atacantes remotos modificar la ventana de título, o posiblemente ejecutar comandos de su elección o sobrescribir archivos, a través de una petición HTTP que contiene una secuencia de escape para el emulador de terminal. Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa are subject to log escape sequence injection vulnerabilities. • https://www.exploit-db.com/exploits/33504 http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041271.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041274.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041285.html http://secunia.com/advisories/39775 http://www.securityfocus.com/archive/1/508830/100/0/threaded http://www.securityfocus.com/bid/37718 http://www.ush.it/team/ush/hack_httpd_escape/adv.txt http://www.vupen&# • CWE-20: Improper Input Validation •