Yaws Yaws
10 CVEs affecting Yaws Yaws. Latest disclosed: 2020-09-09. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24916 | Critical | 9.8 | 2020-09-09 | CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. |
CVE-2020-24379 | Critical | 9.8 | 2020-09-09 | WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. |
CVE-2017-10974 | High | 7.5 | 2017-07-07 | Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial… |
CVE-2011-4350 | Medium | 6.5 | 2019-11-26 | Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of a… |
CVE-2016-1000108 | Medium | 6.1 | 2019-12-10 | yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of… |
CVE-2020-12872 | Medium | 5.5 | 2020-05-15 | yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP… |
CVE-2011-5025 | | 2011-12-29 | Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1)… | |
CVE-2010-4181 | | 2010-11-04 | Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences. | |
CVE-2009-4495 | | 2010-01-13 | Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly exe… | |
CVE-2009-0751 | | 2009-03-02 | Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers. |