CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20355
https://notcve.org/view.php?id=CVE-2018-20355
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Una escritura invalida de 8 bytes debido a una vulnerabilidad use-after-free de la llamada en la función en el mg_http_free_proto_data_cgi in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 y anteriores permiten un servicio de denegación (application crash) o una ejecución de código remoto. • https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-mg_http_free_proto_data_cgi.png • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20354
https://notcve.org/view.php?id=CVE-2018-20354
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Una lectura no válida de 8 bytes debido una vulnerabilidad de use-after-free durante una devolución en la función mg_http_get_proto_data en mongoose.c en Cesanta Mongoose Embedded Web Server Library 6.13 y anteriores permite una denegación de servicio (bloqueo de la aplicación) o un código remoto ejecución. • https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read-mg_http_get_proto_data.png • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20353
https://notcve.org/view.php?id=CVE-2018-20353
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Una lectura no válida de 8 bytes debido a una vulnerabilidad de uso después de una liberación durante una prueba NULL en la función mg_http_get_proto_data en mongoose.c en Embedded Web Server Library 6.13 y anteriores permite una denegación de servicio (bloqueo de la aplicación) o remoto Ejecución de código. • https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read-mg_http_get_proto_data5932.png • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19587
https://notcve.org/view.php?id=CVE-2018-19587
In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function. En Cesanta Mongoose 6.13, existe un SIGSEGV en la función mg_mqtt_add_session() de mongoose.c. • https://github.com/insi2304/mongoose-fuzz • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18765
https://notcve.org/view.php?id=CVE-2018-18765
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. Existe una vulnerabilidad explotable de lectura de memoria arbitraria en la funcionalidad de análisis de paquetes MQTT de Cesanta Mongoose 6.13. • https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md https://twitter.com/thracky/status/1059472674940993541 • CWE-125: Out-of-bounds Read •