CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000470
https://notcve.org/view.php?id=CVE-2017-1000470
EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service. EmbedThis GoAhead Webserver, en versiones 4.0.0 y anteriores, es vulnerable a un desbordamiento de enteros en el agente de escucha HTTP. Esto resulta en una denegación de servicio (DoS). • https://github.com/embedthis/goahead/commit/adeb4abc6c998c19524e09fde20c02b4a26765a3 https://github.com/embedthis/goahead/pull/258 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.1EPSS: 97%CPEs: 3EXPL: 7CVE-2017-17562 – Embedthis GoAhead Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-17562
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0. Embedthis GoAhead en versiones anteriores a la 3.6.5 permite la ejecución remota de código si CGI está habilitado y se enlaza dinámicamente un programa CGI. • https://www.exploit-db.com/exploits/43360 https://www.exploit-db.com/exploits/43877 https://github.com/ivanitlearning/CVE-2017-17562 https://github.com/1337g/CVE-2017-17562 https://github.com/freitzzz/bash-CVE-2017-17562 https://github.com/crispy-peppers/Goahead-CVE-2017-17562 http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.securitytracker.com/id/1040702 https://github.com/elttam/advisories/tree/master/CVE-2017-17562 https://github.com/em •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 1CVE-2017-14149
https://notcve.org/view.php?id=CVE-2017-14149
GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request. GoAhead en versiones de la 3.4.0 a la 3.6.5 presenta una desreferencia de puntero NULL en la función websDecodeUrl en http.c, lo que da lugar a un bloqueo en una petición "POST / HTTP/1.1". • https://github.com/shadow4u/goaheaddebug/blob/master/README.md • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 7%CPEs: 1EXPL: 2CVE-2017-5674
https://notcve.org/view.php?id=CVE-2017-5674
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password. Una vulnerabilidad en un servidor web GoAhead personalizado que se utiliza en Foscam, Vstarcam y múltiples modelos de cámara IP de marca blanca permite a un atacante crear una solicitud HTTP malformada ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" en el campo de la ruta de la solicitud) que revelará el archivo de configuración con la contraseña de inicio de sesión. • https://www.cybereason.com/cve-ip-cameras https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2017-5675
https://notcve.org/view.php?id=CVE-2017-5675
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges. Existe una vulnerabilidad de inyección de comandos en una aplicación web en un servidor web GoAhead personalizado que se utiliza en Foscam, Vstarcam y múltiples moldelos de cámara IP de marca blanca. El formulario de envío de correo en la página mail.htm permite a un atacante inyectar un comando en el campo receiver1 en el formulario; se ejecutará con privilegios de root. • https://www.cybereason.com/cve-ip-cameras https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •