YA
Vendor
Yaws
11
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-24916 | YA Yaws Yaws | 9.8 | Sep 9 | CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection |
| CVE-2020-24379 | YA Yaws Yaws | 9.8 | Sep 9 | WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection |
| CVE-2020-12872 | YA Yaws Yaws | 5.5 | May 15 | yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with… |
| CVE-2016-1000108 | YA Yaws Yaws | 6.1 | Dec 10 | yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client… |
| CVE-2011-4350 | YA Yaws Yaws | 6.5 | Nov 26 | Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed |
| CVE-2017-10974 | YA Yaws Yaws | 7.5 | Jul 7 | Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080 |
| CVE-2011-5025 | YA Yaws Yaws | – | Dec 29 | Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to… |
| CVE-2010-4181 | YA Yaws Yaws | – | Nov 4 | Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences |
| CVE-2009-4495 | YA Yaws Yaws | – | Jan 13 | Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary… |
| CVE-2009-0751 | YA Yaws Yaws | – | Mar 2 | Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers |
| CVE-2005-2008 | WE Webserver Yaws | – | Jun 17 | Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null) |