Vulnerabilities > Lighttpd > Lighttpd > 1.4.1

DATE CVE VULNERABILITY TITLE RISK
2019-04-10 CVE-2019-11072 Integer Overflow or Wraparound vulnerability in Lighttpd
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c.
network
low complexity
lighttpd CWE-190
critical
9.8
2018-11-07 CVE-2018-19052 Path Traversal vulnerability in multiple products
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50.
network
low complexity
lighttpd suse opensuse debian CWE-22
7.5
2015-06-09 CVE-2015-3200 Injection vulnerability in multiple products
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
network
low complexity
lighttpd hp oracle CWE-74
7.5
2014-03-14 CVE-2014-2323 SQL Injection vulnerability in multiple products
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
network
low complexity
lighttpd debian opensuse suse CWE-89
critical
9.8