CVE-2016-1000108

概要

参考情報

• openwall.com/lists/oss-security/2016/07/18/6 · Mailing List
• klacke/yaws commit 9d8fb07 · Patch
• raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000108.json · Third Party Advisory
• security-tracker.debian.org/tracker/CVE-2016-1000108 · Third Party Advisory

yaws のその他の脆弱性

• CVE-2020-24916緊急 9.8CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
• CVE-2020-24379緊急 9.8WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
• CVE-2020-12872中 5.5yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if runnin…
• CVE-2011-4350中 6.5Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to …
• CVE-2017-10974高 7.5Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about…