Filtered by vendor Cesanta
Subscriptions
Filtered by product Mongoose
Subscriptions
Total
27 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-25756 | 1 Cesanta | 1 Mongoose | 2024-06-26 | 9.8 Critical |
| A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice. | ||||
| CVE-2023-34188 | 1 Cesanta | 1 Mongoose | 2023-09-06 | 7.5 High |
| The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests. | ||||
| CVE-2020-25887 | 1 Cesanta | 1 Mongoose | 2023-08-25 | 8.8 High |
| Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. | ||||
| CVE-2023-2905 | 1 Cesanta | 1 Mongoose | 2023-08-16 | 8.8 High |
| Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11. | ||||
| CVE-2019-13503 | 1 Cesanta | 1 Mongoose | 2023-01-30 | 7.5 High |
| mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. | ||||
| CVE-2018-18764 | 1 Cesanta | 1 Mongoose | 2022-10-03 | N/A |
| An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2909 | 1 Cesanta | 1 Mongoose | 2022-06-13 | 7.5 High |
| An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2921 | 1 Cesanta | 1 Mongoose | 2022-06-13 | 9.8 Critical |
| An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow and resulting in denial of service and potential remote code execution. An attacker needs to send a specially crafted websocket packet over network to trigger this vulnerability. | ||||
| CVE-2017-2922 | 1 Cesanta | 1 Mongoose | 2022-06-13 | 9.8 Critical |
| An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2895 | 1 Cesanta | 1 Mongoose | 2022-06-07 | 8.2 High |
| An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2894 | 1 Cesanta | 1 Mongoose | 2022-06-07 | 9.8 Critical |
| An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2893 | 1 Cesanta | 1 Mongoose | 2022-06-07 | 7.5 High |
| An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2892 | 1 Cesanta | 1 Mongoose | 2022-06-07 | 9.8 Critical |
| An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. | ||||
| CVE-2017-2891 | 1 Cesanta | 1 Mongoose | 2022-06-07 | 9.8 Critical |
| An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability. | ||||
| CVE-2022-25299 | 1 Cesanta | 1 Mongoose | 2022-02-28 | 7.5 High |
| This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder. | ||||
| CVE-2021-26530 | 1 Cesanta | 1 Mongoose | 2021-02-12 | 9.1 Critical |
| The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. | ||||
| CVE-2021-26529 | 1 Cesanta | 1 Mongoose | 2021-02-12 | 9.1 Critical |
| The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. | ||||
| CVE-2021-26528 | 1 Cesanta | 1 Mongoose | 2021-02-12 | 9.1 Critical |
| The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool. | ||||
| CVE-2019-12951 | 1 Cesanta | 1 Mongoose | 2020-08-24 | N/A |
| An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow. | ||||
| CVE-2019-19307 | 1 Cesanta | 1 Mongoose | 2020-08-24 | 9.8 Critical |
| An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet. | ||||