Vulnerabilities > Lighttpd > Lighttpd > 1.4.7
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2007-07-24 | CVE-2007-3947 | Unspecified vulnerability in Lighttpd request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault. network lighttpd | 5.8 |
2007-07-24 | CVE-2007-3946 | Unspecified vulnerability in Lighttpd mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header. | 6.4 |
2007-04-18 | CVE-2007-1870 | Remote Denial of Service vulnerability in Lighttpd lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference. | 7.8 |
2006-03-06 | CVE-2006-0814 | Remote Script Disclosure vulnerability in Lighttpd response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. | 5.0 |
2006-02-18 | CVE-2006-0760 | Information Disclosure vulnerability in lightrpd LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names. | 2.6 |