cherokee-project cherokee vulnerabilities and exploits

(subscribe to this query)

6.8

CVSSv2

Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee prior to 1.2.99 allows remote malicious users to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to...

2.1

CVSSv2

The generate_admin_password function in Cherokee prior to 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.

6.8

CVSSv2

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and previous versions, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote malicious users to bypass authentication via an empty password.

Fedoraproject Fedora 21 Fedoraproject Fedora 20 Fedoraproject Fedora 22 Mageia Project Mageia 4 Cherokee-project Cherokee 1.2.98 Cherokee-project Cherokee 1.2.2 Cherokee-project Cherokee 1.2.101 Cherokee-project Cherokee 1.2.99 Cherokee-project Cherokee Cherokee-project Cherokee 1.2.102

5

CVSSv2

header.c in Cherokee prior to 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote malicious users to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an esca...

Cherokee-project Cherokee

1 EDB exploit

5

CVSSv2

In Cherokee up to and including 1.2.104, multiple memory corruption errors may be used by a remote malicious user to destabilize the work of a server.

Cherokee-project Cherokee

7.5

CVSSv2

In Cherokee up to and including 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers.

Cherokee-project Cherokee

5

CVSSv2

Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_b...

Cherokee-project Cherokee

6

CVSSv2

An XSS issue exists in handler_server_info.c in Cherokee up to and including 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfig...

Cherokee-project Cherokee

5

CVSSv2

Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version ...

Cherokee-project Cherokee Web Server

3 Github repositories

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook