Login Request a demo
YA
Product
Yaws
by Yaws · last CVE Sep 9, 2020
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 2High 1Medium 3Low 0
Severity
All severities10Critical2High1Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Yaws to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-24916
9.8
17%
Sep 9
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection
Affected: 1.81 through 2.0.7
CVE-2020-24379
9.8
3%
Sep 9
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection
Affected: 1.81 through 2.0.7
CVE-2017-10974
7.5
81%
Jul 7
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080
Affected: 1.91
CVE-2011-4350
6.5
16%
Nov 26
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed
Affected: 1.91
CVE-2016-1000108
6.1
1%
Dec 10
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client…
Affected: before 2.0.4
CVE-2020-12872
5.5
0%
May 15
yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with…
Affected: 2.0.2 through 2.0.6
CVE-2011-5025
–
3%
Dec 29
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to…
Affected: 1.88
CVE-2010-4181
–
8%
Nov 4
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences
Affected: 1.89
CVE-2009-4495
–
10%
Jan 13
Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary…
Affected: 1.85
CVE-2009-0751
–
10%
Mar 2
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers
Affected: through 1.79; 1.50; 1.51; 1.52; 1.53; 1.54; +21 more
Showing 10