Cherokee-Project

9 CVEs across 2 Cherokee-Project products. Browse Cherokee-Project vulnerabilities, severities, and proof-of-concept exploits.

Cherokee-Project products with known CVEs

ProductCVEs
Cherokee8
Cherokee Web Server1
Cherokee-Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2020-12845High7.52020-07-27Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sen…
CVE-2019-20800Critical9.82020-05-18In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request…
CVE-2019-20799High7.52020-05-18In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.
CVE-2019-20798High8.42020-05-18An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default co…
CVE-2019-1010218High7.52019-07-22Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The compon…
CVE-2014-46682014-07-02The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-b…
CVE-2011-21912011-10-07Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrat…
CVE-2011-21902011-10-07The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for loc…
CVE-2009-44892010-01-13header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a windo…