Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Hiawatha-webserver Component: Hiawatha Clear all filters
TI-2025-35667 CVE-2025-57784 · GHSA-h568-qr59-9xpj

Tomahawk authentication timing attack due to usage of 'strcmp'

Priority LOW 18

Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00167 Published 2026-01-26 No fix listed
TI-2025-35666 CVE-2025-57783 · GHSA-mrpv-h52h-rxhw

Improper header parsing may lead to request smuggling

Priority LOW 30

Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00472 Published 2026-01-26 No fix listed