Yaws

11 CVEs across 2 Yaws products. Browse Yaws vulnerabilities, severities, and proof-of-concept exploits.

Yaws products with known CVEs

ProductCVEs
Yaws10
Webserver1
Yaws CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2020-24916Critical9.82020-09-09CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
CVE-2020-24379Critical9.82020-09-09WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
CVE-2020-12872Medium5.52020-05-15yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP…
CVE-2016-1000108Medium6.12019-12-10yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of…
CVE-2011-4350Medium6.52019-11-26Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of a…
CVE-2017-10974High7.52017-07-07Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial…
CVE-2011-50252011-12-29Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1)…
CVE-2010-41812010-11-04Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences.
CVE-2009-44952010-01-13Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly exe…
CVE-2009-07512009-03-02Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers.
CVE-2005-20082005-06-17Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null).