Yaws vulnerabilities

Products

• Yaws 10

Newest

• yaws, canonical ubuntu linux, debian linux +2 more CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. CVE-2020-24916 Fix available EPSS 17.4% 9.8 CriticalSeptember 9, 2020
• yaws, canonical ubuntu linux, debian linux +2 more WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. CVE-2020-24379 Fix available 9.8 CriticalSeptember 9, 2020
• yaws yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by... CVE-2020-12872 Fix available 5.5 MediumMay 15, 2020
• yaws, debian linux +1 more yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and... CVE-2016-1000108 Fix available 6.1 MediumDecember 10, 2019
• yaws, debian linux +1 more Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote... CVE-2011-4350 Fix available EPSS 16.1% 6.5 MediumNovember 26, 2019
• yaws Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../... CVE-2017-10974 Public exploitFix available EPSS 81.0% 7.5 HighJuly 7, 2017
• yaws Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow... CVE-2011-5025 Public exploitFix available 4.3 MediumDecember 29, 2011
• yaws Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files... CVE-2010-4181 Public exploit 5.0 MediumNovember 4, 2010
• yaws Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might... CVE-2009-4495 Public exploit 5.0 MediumJanuary 13, 2010
• yaws Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and... CVE-2009-0751 Public exploitFix available EPSS 10.4% 5.0 MediumMarch 2, 2009
• yaws webserver Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws... CVE-2005-2008 Fix available 5.0 MediumJune 17, 2005