{"kind": "product", "path": "vulns/debian-12/lighttpd", "name": "lighttpd", "product": "lighttpd", "ecosystem": "Debian:12", "items": [{"id": "CVE-2018-25103", "noindex": false, "published": "2024-06-17T18:02:57.162Z", "modified": "2025-09-15T20:05:35.756Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00667, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-25103", "title": "Use-after-free vulnerabilities in lighttpd <= 1.4.50", "description": "There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.", "references": ["https://blogvdoo.wordpress.com/2018/11/06/giving-back-securing-open-source-iot-projects/#more-736", "https://www.runzero.com/blog/lighttpd/", "https://github.com/lighttpd/lighttpd1.4/commit/df8e4f95614e476276a55e34da2aa8b00b1148e9"], "fixes": ["1.4.52-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-41556", "noindex": false, "published": "2022-10-06T00:00:00.000Z", "modified": "2024-08-03T12:42:46.654Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.03799, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-41556", "title": "CVE-2022-41556", "description": "A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.", "references": ["https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50", "https://github.com/lighttpd/lighttpd1.4/pull/115", "https://github.com/lighttpd/lighttpd1.4/compare/lighttpd-1.4.66...lighttpd-1.4.67"], "fixes": ["1.4.67-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-37797", "noindex": false, "published": "2022-09-12T00:00:00.000Z", "modified": "2024-08-03T10:37:41.657Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02549, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-37797", "title": "CVE-2022-37797", "description": "In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.", "references": ["https://redmine.lighttpd.net/issues/3165", "https://www.debian.org/security/2022/dsa-5243", "https://lists.debian.org/debian-lts-announce/2022/10/msg00002.html"], "fixes": ["1.4.66-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-30780", "noindex": false, "published": "2022-06-11T14:40:53.000Z", "modified": "2024-08-03T06:56:14.103Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.57194, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-30780", "title": "CVE-2022-30780", "description": "Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.", "references": ["https://github.com/lighttpd/lighttpd1.4", "https://redmine.lighttpd.net/issues/3059", "https://podalirius.net/en/cves/2022-30780/"], "fixes": ["1.4.59-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2022-22707", "noindex": false, "published": "2022-01-06T05:55:30.000Z", "modified": "2024-08-03T03:21:48.853Z", "cvss": 5.9, "cvss_vector": "", "severity": "medium", "epss": 0.08929, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-22707", "title": "CVE-2022-22707", "description": "In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.", "references": ["https://redmine.lighttpd.net/issues/3134", "https://www.debian.org/security/2022/dsa-5040", "https://nvd.nist.gov/vuln/detail/CVE-2022-22707"], "fixes": ["1.4.64-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2019-11072", "noindex": false, "published": "2019-04-10T21:04:57.000Z", "modified": "2024-08-04T22:40:16.264Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.73762, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-11072", "title": "CVE-2019-11072", "description": "lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states \"The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will f", "references": ["https://redmine.lighttpd.net/issues/2945", "https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354", "http://www.securityfocus.com/bid/107907"], "fixes": ["1.4.53-4"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2018-19052", "noindex": false, "published": "2018-11-07T05:00:00.000Z", "modified": "2024-08-05T11:30:04.022Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.13714, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-19052", "title": "CVE-2018-19052", "description": "An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.", "references": ["https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html", "https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html"], "fixes": ["1.4.52-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2016-1000212", "noindex": false, "published": "2016-07-27T00:00:00Z", "modified": "2026-04-22T10:28:12.553121Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-1000212", "title": "UBUNTU-CVE-2016-1000212", "description": "Mitigation for HTTPoxy vulnerability", "references": ["https://ubuntu.com/security/CVE-2016-1000212", "https://redmine.lighttpd.net/projects/lighttpd/repository/revisions/779c133c16f9af168b004dce7a2a64f16c1cb3a4/diff", "https://www.cve.org/CVERecord?id=CVE-2016-1000212"], "fixes": ["1.4.43-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2015-3200", "noindex": false, "published": "2015-06-09T14:00:00.000Z", "modified": "2024-08-06T05:39:31.929Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.09909, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2015-3200", "title": "CVE-2015-3200", "description": "mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.", "references": ["http://www.securityfocus.com/bid/74813", "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375", "http://redmine.lighttpd.net/issues/2646"], "fixes": ["1.4.37-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2014-3566", "noindex": false, "published": "2014-10-15T00:00:00.000Z", "modified": "2026-05-28T17:35:01.304Z", "cvss": 3.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "severity": "low", "epss": 0.99999, "kev": false, "exploits": ["metasploit"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3566", "title": "CVE-2014-3566", "description": "The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the \"POODLE\" issue.", "references": ["http://marc.info/?l=bugtraq&m=142103967620673&w=2", "http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc", "http://www.securitytracker.com/id/1031090"], "fixes": ["1.4.35-4"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2014-2324", "noindex": false, "published": "2014-03-14T15:00:00.000Z", "modified": "2024-08-06T10:06:00.322Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.29521, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-2324", "title": "CVE-2014-2324", "description": "Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.", "references": ["http://www.lighttpd.net/2014/3/12/1.4.35/", "http://www.securityfocus.com/bid/66157", "http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt"], "fixes": ["1.4.33-1+nmu3"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2014-2323", "noindex": false, "published": "2014-03-14T15:00:00.000Z", "modified": "2024-08-06T10:06:00.483Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.62752, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-2323", "title": "CVE-2014-2323", "description": "SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.", "references": ["http://www.lighttpd.net/2014/3/12/1.4.35/", "http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt", "http://www.debian.org/security/2014/dsa-2877"], "fixes": ["1.4.33-1+nmu3"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2013-4560", "noindex": false, "published": "2013-11-19T19:00:00.000Z", "modified": "2024-08-06T16:45:14.824Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.05418, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-4560", "title": "CVE-2013-4560", "description": "Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.", "references": ["http://secunia.com/advisories/55682", "http://marc.info/?l=bugtraq&m=141576815022399&w=2", "http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt"], "fixes": ["1.4.33-1+nmu1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2013-4559", "noindex": false, "published": "2013-11-19T19:00:00.000Z", "modified": "2024-08-06T16:45:14.842Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.10721, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-4559", "title": "CVE-2013-4559", "description": "lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.", "references": ["http://secunia.com/advisories/55682", "http://marc.info/?l=bugtraq&m=141576815022399&w=2", "http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt"], "fixes": ["1.4.33-1+nmu1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2013-4508", "noindex": false, "published": "2013-11-08T02:00:00.000Z", "modified": "2024-08-06T16:45:15.220Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02626, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-4508", "title": "CVE-2013-4508", "description": "lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.", "references": ["http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt", "http://openwall.com/lists/oss-security/2013/11/04/19", "http://marc.info/?l=bugtraq&m=141576815022399&w=2"], "fixes": ["1.4.33-1+nmu1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2013-1427", "noindex": false, "published": "2013-03-21T17:00:00.000Z", "modified": "2024-08-06T15:04:48.266Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-1427", "title": "CVE-2013-1427", "description": "The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.", "references": ["http://osvdb.org/91462", "https://exchange.xforce.ibmcloud.com/vulnerabilities/82897", "http://www.securityfocus.com/bid/58528"], "fixes": ["1.4.31-4"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2012-5533", "noindex": false, "published": "2012-11-24T20:00:00.000Z", "modified": "2024-08-06T21:05:47.345Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.12038, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2012-5533", "title": "CVE-2012-5533", "description": "The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the \"Connection: TE,,Keep-Alive\" header.", "references": ["http://www.openwall.com/lists/oss-security/2012/11/21/1", "http://lists.opensuse.org/opensuse-updates/2012-11/msg00044.html", "http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt"], "fixes": ["1.4.31-2"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2012-4929", "noindex": false, "published": "2012-09-15T18:00:00.000Z", "modified": "2024-08-06T20:50:18.019Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.04346, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2012-4929", "title": "CVE-2012-4929", "description": "The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a \"CRIME\" attack.", "references": ["http://marc.info/?l=bugtraq&m=136612293908376&w=2", "http://rhn.redhat.com/errata/RHSA-2013-0587.html", "http://www.debian.org/security/2012/dsa-2579"], "fixes": ["1.4.30-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2011-4362", "noindex": false, "published": "2011-12-24T19:00:00.000Z", "modified": "2024-08-07T00:09:18.360Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.21106, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2011-4362", "title": "CVE-2011-4362", "description": "Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.", "references": ["http://secunia.com/advisories/47260", "http://archives.neohapsis.com/archives/bugtraq/2011-12/0167.html", "http://www.openwall.com/lists/oss-security/2011/11/29/8"], "fixes": ["1.4.30-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}, {"id": "CVE-2011-3389", "noindex": false, "published": "2011-09-06T19:00:00.000Z", "modified": "2026-10-09T19:05:55.192Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.73327, "kev": false, "exploits": ["metasploit"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2011-3389", "title": "CVE-2011-3389", "description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "references": ["http://osvdb.org/74829", "http://eprint.iacr.org/2004/111", "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"], "fixes": ["1.4.30-1"], "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}]}], "total": 37, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "lighttpd", "path": "vulns/debian-12/lighttpd", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-09T19:05:55.192Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}