Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
107 results · page 2 of 3
Nov 18, 2024Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applicatCVE-2024-42388 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 5.3
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applicatCVE-2024-42387 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 5.3
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentaCVE-2024-42386 · Other software · Cesanta · reported by prodsec@nozominetworks.comHigh 8.2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comcert-portal.siemens.com
Nov 18, 2024Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate cCVE-2024-42385 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 4
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comcert-portal.siemens.com
Nov 18, 2024Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentationCVE-2024-42384 · Other software · Cesanta · reported by prodsec@nozominetworks.comHigh 7.5
Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comcert-portal.siemens.com
Nov 18, 2024Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for thCVE-2024-42383 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 4.2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2024Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c.CVE-2024-35492 · Other software · cesanta · reported by MITREHigh 7.5
Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MQTT packet.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the deviceCVE-2023-4518 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.5
A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.
- Product
- Relion670
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Aug 22, 2023Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.CVE-2020-25887 · Other software · Cesanta · reported by MITREHigh 8.8
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web serveCVE-2023-2905 · Other software · Cesanta · reported by cve@takeonme.orgHigh 8.8
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.CVE-2023-3696 · Other software · automattic · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
- Product
- automattic/mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.CVE-2023-34188 · Other software · Cesanta · reported by MITREHigh 7.5
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.narfindustries.comgithub.com
Jan 23, 2023Mongoose Page: Does not validate and escape one of its shortcode attributesCVE-2022-4675 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Mongoose Page
- Fixed in
- 1.9.0
- What to do
- Update Mongoose Page to 1.9.0 or newer.
Jul 28, 2022Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.CVE-2022-2564 · Other software · automattic · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Product
- automattic/mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc.CVE-2021-27425 · Other software · Cesanta Software · reported by ics-cert@hq.dhs.govHigh 7.3
Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
- Product
- Mongoose-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service.CVE-2022-1302 · Other software · MZ Automation · reported by info@cert.vde.comHigh 7.5
In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service.
- Product
- libIEC61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibiec61850.comlibiec61850.com
Feb 18, 2022This affects the package cesanta/mongoose before 7.6.CVE-2022-25299 · Other software · Cesanta · reported by report@snyk.ioCritical 9.8
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which canCVE-2021-31875 · Other software · Cesanta · reported by MITRECritical 9.8
In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."
- Product
- Mongooseos MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request afCVE-2021-26530 · Other software · Cesanta · reported by MITRECritical 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connectiCVE-2021-26529 · Other software · Cesanta · reported by MITRECritical 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory poolCVE-2021-26528 · Other software · Cesanta · reported by MITRECritical 9.1
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking.CVE-2020-25756 · Other software · Cesanta · reported by MITRECritical 9.8
A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2019An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bCVE-2019-19307 · Other software · Cesanta · reported by MITRECritical 9.8
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignoreCVE-2019-17426 · Other software · Mongoosejs · reported by MITRECritical 9.1
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2019libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.CVE-2019-16510 · Other software · Mz-automation · reported by MITREHigh 7.5
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.
- Product
- Libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2019mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.CVE-2019-13503 · Other software · Cesanta · reported by MITREHigh 7.5
mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2019An issue was discovered in Mongoose before 6.15.CVE-2019-12951 · Other software · Cesanta · reported by MITRECritical 9.8
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2019An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded WebCVE-2018-20356 · Other software · Cesanta · reported by MITRECritical 9.8
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2019An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded WeCVE-2018-20355 · Other software · Cesanta · reported by MITRECritical 9.8
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2019An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose EmbeCVE-2018-20354 · Other software · Cesanta · reported by MITRECritical 9.8
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2019An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose ECVE-2018-20353 · Other software · Cesanta · reported by MITRECritical 9.8
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2019Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial ofCVE-2018-20352 · Other software · Cesanta · reported by MITREHigh 8.8
Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
- Product
- Mongoose Embedded Web Server Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.CVE-2018-19587 · Other software · Cesanta · reported by MITREMedium 6.5
In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.CVE-2018-18765 · Other software · Cesanta · reported by MITRECritical 9.1
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.CVE-2018-18764 · Other software · Cesanta · reported by MITRECritical 9.1
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2018The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crasCVE-2018-10945 · Other software · Cesanta · reported by MITREHigh 7.5
The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hac425.topblog.hac425.top
May 31, 2018express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models.CVE-2016-10533 · Other software · HackerOne · reported by support@hackerone.comHigh 8.8
express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.
- Product
- express-restify-mongoose node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Nov 7, 2017An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.CVE-2017-2922 · Other software · Cesanta · reported by talos-cna@cisco.comCritical 9.8
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.CVE-2017-2921 · Other software · Cesanta · reported by talos-cna@cisco.comCritical 9.8
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow and resulting in denial of service and potential remote code execution. An attacker needs to send a specially crafted websocket packet over network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library.CVE-2017-2909 · Other software · Cesanta · reported by talos-cna@cisco.comHigh 7.5
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.CVE-2017-2895 · Other software · Cesanta · reported by talos-cna@cisco.comHigh 8.2
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.CVE-2017-2894 · Other software · Cesanta · reported by talos-cna@cisco.comCritical 9.8
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.CVE-2017-2893 · Other software · Cesanta · reported by talos-cna@cisco.comHigh 7.5
An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.CVE-2017-2892 · Other software · Cesanta · reported by talos-cna@cisco.comCritical 9.8
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 7, 2017An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8.CVE-2017-2891 · Other software · Cesanta · reported by talos-cna@cisco.comCritical 9.8
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 7, 2017Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests thaCVE-2017-11567 · Other software · Cesanta · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.
- Product
- Mongoose Embedded Web Server Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgseclists.org
Apr 10, 2017Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier aCVE-2017-7185 · Other software · Cesanta · reported by MITREHigh 7.5
Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
- Product
- Mongoose Embedded Web Server Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Apr 10, 2014Erlang Solutions MongooseIM through 1.3.1 rev.CVE-2014-2829 · Other software · Erlang-solutions · reported by MITREHigh 7.8
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
- Product
- Mongooseim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2011Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWSCVE-2011-2900 · Other software · Shttpd · reported by Red HatHigh 7.5
Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.
- Product
- Shttpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Dec 31, 2009Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI.CVE-2009-4535 · Other software · Valenok · reported by MITREMedium 5
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreetexthost.compocoftheday.blogspot.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.