Cherokee-project Cherokee
8 CVEs affecting Cherokee-project Cherokee. Latest disclosed: 2020-07-27. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-20800 | Critical | 9.8 | 2020-05-18 | In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request… |
CVE-2019-20798 | High | 8.4 | 2020-05-18 | An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default co… |
CVE-2020-12845 | High | 7.5 | 2020-07-27 | Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sen… |
CVE-2019-20799 | High | 7.5 | 2020-05-18 | In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server. |
CVE-2014-4668 | | 2014-07-02 | The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-b… | |
CVE-2011-2191 | | 2011-10-07 | Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrat… | |
CVE-2011-2190 | | 2011-10-07 | The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for loc… | |
CVE-2009-4489 | | 2010-01-13 | header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a windo… |