Acme Thttpd — known CVE vulnerabilities

Every CVE whose affected-product data names Acme Thttpd, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2017-17663 — CVSS 9.8 (critical): The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited…
• CVE-2001-1496 — CVSS 9.8 (critical): Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of…
• CVE-2003-0899 — CVSS 9.8 (critical): Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that…
• CVE-2007-0158 — CVSS 9.8 (critical): thttpd 2007 has buffer underflow.
• CVE-2009-4491 — CVSS 9.8 (critical): thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a…
• CVE-2012-5640 — CVSS 5.5 (medium): thttpd has a local DoS vulnerability via specially-crafted .htpasswd files
• CVE-2001-0892 — CVSS 5.0 (medium): Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the…
• CVE-2013-0348 — CVSS 2.1 (low): thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to…