CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20354
https://notcve.org/view.php?id=CVE-2018-20354
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Una lectura no válida de 8 bytes debido una vulnerabilidad de use-after-free durante una devolución en la función mg_http_get_proto_data en mongoose.c en Cesanta Mongoose Embedded Web Server Library 6.13 y anteriores permite una denegación de servicio (bloqueo de la aplicación) o un código remoto ejecución. • https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read-mg_http_get_proto_data.png • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20353
https://notcve.org/view.php?id=CVE-2018-20353
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Una lectura no válida de 8 bytes debido a una vulnerabilidad de uso después de una liberación durante una prueba NULL en la función mg_http_get_proto_data en mongoose.c en Embedded Web Server Library 6.13 y anteriores permite una denegación de servicio (bloqueo de la aplicación) o remoto Ejecución de código. • https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read-mg_http_get_proto_data5932.png • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19587
https://notcve.org/view.php?id=CVE-2018-19587
In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function. En Cesanta Mongoose 6.13, existe un SIGSEGV en la función mg_mqtt_add_session() de mongoose.c. • https://github.com/insi2304/mongoose-fuzz • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18765
https://notcve.org/view.php?id=CVE-2018-18765
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. Existe una vulnerabilidad explotable de lectura de memoria arbitraria en la funcionalidad de análisis de paquetes MQTT de Cesanta Mongoose 6.13. • https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md https://twitter.com/thracky/status/1059472674940993541 • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-18764
https://notcve.org/view.php?id=CVE-2018-18764
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. Existe una vulnerabilidad explotable de lectura de memoria arbitraria en la funcionalidad de análisis de paquetes MQTT de Cesanta Mongoose 6.13. • https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow1.md https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow2.md • CWE-125: Out-of-bounds Read •