Vulnerabilities > Lighttpd > Lighttpd > 1.3.15
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-10-03 | CVE-2008-4359 | Information Exposure vulnerability in multiple products lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data. | 7.5 |
| 2008-09-27 | CVE-2008-4298 | Resource Management Errors vulnerability in Lighttpd Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers. | 5.0 |
| 2008-03-27 | CVE-2008-1531 | Denial of Service vulnerability in Lighttpd SSL Error The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost. | 4.3 |
| 2008-03-10 | CVE-2008-1270 | Information Exposure vulnerability in Lighttpd mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. | 5.0 |
| 2007-09-12 | CVE-2007-4727 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Lighttpd Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow." | 6.8 |
| 2007-07-24 | CVE-2007-3950 | Unspecified vulnerability in Lighttpd lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) mod_scgi, (2) mod_fastcgi, and (3) mod_webdav modules. network lighttpd | 4.3 |
| 2007-07-24 | CVE-2007-3949 | Unspecified vulnerability in Lighttpd mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings. network lighttpd | 8.3 |
| 2007-07-24 | CVE-2007-3948 | Unspecified vulnerability in Lighttpd connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service (failed assertion) via a large number of connection attempts. network lighttpd | 4.3 |
| 2007-07-24 | CVE-2007-3947 | Unspecified vulnerability in Lighttpd request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault. network lighttpd | 5.8 |
| 2007-07-24 | CVE-2007-3946 | Unspecified vulnerability in Lighttpd mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header. | 6.4 |