Filtered by vendor Cesanta
Subscribe
Total
131 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-33448 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390.
|
|||||
| CVE-2021-33447 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.
|
|||||
| CVE-2021-33446 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
|
|||||
| CVE-2021-33445 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
|
|||||
| CVE-2021-33444 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
|
|||||
| CVE-2021-33443 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c.
|
|||||
| CVE-2021-33442 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
|
|||||
| CVE-2021-33441 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
|
|||||
| CVE-2021-33440 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
|
|||||
| CVE-2021-33439 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c.
|
|||||
| CVE-2021-33438 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c.
|
|||||
| CVE-2021-33437 | 1 Cesanta | 1 Mjs | 2024-11-21 | N/A | 5.5 MEDIUM |
|
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.
|
|||||
| CVE-2021-31875 | 1 Cesanta | 1 Mongooseos Mjs | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."
|
|||||
| CVE-2021-27425 | 1 Cesanta | 1 Mongoose Os | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
|
Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
|
|||||
| CVE-2021-26530 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
|
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
|
|||||
| CVE-2021-26529 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
|
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
|
|||||
| CVE-2021-26528 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
|
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
|
|||||
| CVE-2020-36375 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_equality Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36374 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_comparison Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36373 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_shifts Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36372 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_plus_minus Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36371 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_mul_div_rem Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36370 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36369 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_statement_list Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36368 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36367 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-36366 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2020-25887 | 1 Cesanta | 1 Mongoose | 2024-11-21 | N/A | 8.8 HIGH |
|
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
|
|||||
| CVE-2020-25756 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.
|
|||||
| CVE-2020-18392 | 1 Cesanta | 1 Mjs | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
|
Stack overflow vulnerability in parse_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
|
|||||
| CVE-2019-19307 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
|
|||||
| CVE-2019-13503 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
|
|||||
| CVE-2019-12951 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
|
|||||
| CVE-2018-20356 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
|
|||||
| CVE-2018-20355 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
|
|||||
| CVE-2018-20354 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
|
|||||
| CVE-2018-20353 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
|
|||||
| CVE-2018-20352 | 1 Cesanta | 1 Mongoose Embedded Web Server Library | 2024-11-21 | 6.8 MEDIUM | 8.8 HIGH |
|
Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
|
|||||
| CVE-2018-19587 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.
|
|||||
| CVE-2018-18765 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
|
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
|
|||||