Vulnerabilities (CVE)

Filtered by vendor Cesanta Subscribe
Filtered by product Mongoose
Total 36 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-34188 1 Cesanta 1 Mongoose 2024-02-04 N/A 7.5 HIGH
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.
CVE-2022-25299 1 Cesanta 1 Mongoose 2024-02-04 5.0 MEDIUM 7.5 HIGH
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.
CVE-2021-26530 1 Cesanta 1 Mongoose 2024-02-04 6.4 MEDIUM 9.1 CRITICAL
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVE-2021-26528 1 Cesanta 1 Mongoose 2024-02-04 6.4 MEDIUM 9.1 CRITICAL
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVE-2021-26529 1 Cesanta 1 Mongoose 2024-02-04 6.4 MEDIUM 9.1 CRITICAL
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVE-2019-19307 1 Cesanta 1 Mongoose 2024-02-04 7.5 HIGH 9.8 CRITICAL
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
CVE-2018-20356 1 Cesanta 1 Mongoose 2024-02-04 7.5 HIGH 9.8 CRITICAL
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
CVE-2019-12951 1 Cesanta 1 Mongoose 2024-02-04 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
CVE-2018-20353 1 Cesanta 1 Mongoose 2024-02-04 7.5 HIGH 9.8 CRITICAL
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
CVE-2018-20355 1 Cesanta 1 Mongoose 2024-02-04 7.5 HIGH 9.8 CRITICAL
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
CVE-2019-13503 1 Cesanta 1 Mongoose 2024-02-04 5.0 MEDIUM 7.5 HIGH
mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
CVE-2018-20354 1 Cesanta 1 Mongoose 2024-02-04 7.5 HIGH 9.8 CRITICAL
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
CVE-2018-18765 1 Cesanta 1 Mongoose 2024-02-04 6.4 MEDIUM 9.1 CRITICAL
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVE-2018-18764 1 Cesanta 1 Mongoose 2024-02-04 6.4 MEDIUM 9.1 CRITICAL
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVE-2018-19587 1 Cesanta 1 Mongoose 2024-02-04 4.3 MEDIUM 6.5 MEDIUM
In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.
CVE-2018-10945 1 Cesanta 1 Mongoose 2024-02-04 5.0 MEDIUM 7.5 HIGH
The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.