Vulnerabilities > Lighttpd > Lighttpd > 1.4.17
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-10-03 | CVE-2008-4360 | Information Exposure vulnerability in multiple products mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files. | 7.5 |
| 2008-10-03 | CVE-2008-4359 | Information Exposure vulnerability in multiple products lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data. | 7.5 |
| 2008-09-27 | CVE-2008-4298 | Resource Management Errors vulnerability in Lighttpd Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers. | 5.0 |
| 2008-03-27 | CVE-2008-1531 | Denial of Service vulnerability in Lighttpd SSL Error The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost. | 4.3 |
| 2008-03-10 | CVE-2008-1270 | Information Exposure vulnerability in Lighttpd mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. | 5.0 |
| 2008-02-26 | CVE-2008-0983 | Resource Management Errors vulnerability in Lighttpd lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access. | 5.0 |