CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-25887
https://notcve.org/view.php?id=CVE-2020-25887
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. Desbordamiento del búfer en mg_resolve_from_hosts_file en Mongoose 6.18, cuando se lee de un archivo hosts manipulado. • https://github.com/cesanta/mongoose/issues/1140 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2905 – Cesanta Mongoose MQTT Message Parsing Heap Overflow
https://notcve.org/view.php?id=CVE-2023-2905
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11. • https://github.com/cesanta/mongoose/pull/2274 https://github.com/cesanta/mongoose/releases/tag/7.11 https://takeonme.org/cves/CVE-2023-2905.html • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34188
https://notcve.org/view.php?id=CVE-2023-34188
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests. • https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f https://github.com/cesanta/mongoose/compare/7.9...7.10 https://github.com/cesanta/mongoose/pull/2197 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27425 – Cesanta Software Mongoose-OS Integer Overflow or Wraparound
https://notcve.org/view.php?id=CVE-2021-27425
Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. Cesanta Software Mongoose-OS versión v2.17.0, es vulnerable a una envoltura de enteros en la función mm_malloc. Esta asignación de memoria inapropiada puede conllevar a una asignación de memoria arbitraria, resultando en un comportamiento no esperado, como un bloqueo o una inyección/ejecución de código remoto • https://github.com/cesanta/mongoose-os https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-25299 – Arbitrary File Write
https://notcve.org/view.php?id=CVE-2022-25299
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder. Esto afecta al paquete cesanta/mongoose versiones anteriores a 7.6. Un manejo no seguro de los nombres de archivo durante la carga usando el método mg_http_upload() puede permitir a atacantes escribir archivos en ubicaciones arbitrarias fuera de la carpeta de destino designada • https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945 https://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180 • CWE-552: Files or Directories Accessible to External Parties •