CVE

Id
41930  
CVE No.
CVE-2009-4495  
Status
Candidate  
Description
Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window"s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.  
Phase
Assigned (20091230)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
459612 41930 CVE-2009-4495 BUGTRAQ:20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection  View
459613 41930 CVE-2009-4495 URL:http://www.securityfocus.com/archive/1/archive/1/508830/100/0/threaded  View
459614 41930 CVE-2009-4495 MISC:http://www.ush.it/team/ush/hack_httpd_escape/adv.txt  View
459615 41930 CVE-2009-4495 BID:37716  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41607 JVNDB-2009-002614 Zabbix サーバの get_history_lastid 関数における SQL インジェクションの脆弱性 Zabbix サーバの nodewatcher コンポーネント内にある get_history_lastid 関数には、SQL インジェクションの脆弱性が存在します。 CVE-2009-4499 41930 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002614.html  View