BO
Product
Boa
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 1Low 0
Watch
Add Boa to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-44117 | 9.8 | Nov 23 | Boa 0.94.14rc21 is vulnerable to SQL Injection via username Affected: 0.94.14.21 |
| CVE-2018-21027 | 9.8 | Oct 11 | Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled Affected: through 0.94.14.21 |
| CVE-2024-43367 | 7.5 | Aug 15 | Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects Affected: through 0.16; through 0.19.0 |
| CVE-2021-33558 | 7.5 | May 27 | Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html,… Affected: 0.94.13 |
| CVE-2018-21028 | 7.5 | Oct 11 | Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function Affected: through 0.94.14.21 |
| CVE-2017-9833 | 7.5 | Jun 24 | /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges Affected: 0.94.14.21 |
| CVE-2016-9564 | 7.5 | Nov 30 | Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' characters Affected: 0.92r |
| CVE-2022-45956 | 5.3 | Dec 12 | Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization… Affected: 0.94.13; 0.94.14 |
| CVE-2009-4496 | – | Jan 13 | Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary… Affected: 0.94.14rc21 |
Showing 9