Cesanta records

145 published records for vendor cesanta.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 13
With a fix record: 26.9%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

145 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
51Plan	CVE-2019-19307No exploit	An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibcesanta · mongoose · CWE-125 Pre-auth Memory safety	Critical9.8	—	41.6%	Nov 26, 2019
48Plan	CVE-2017-2894No exploit	An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.cesanta · mongoose · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	31.0%	Nov 7, 2017
40Plan	CVE-2018-20353No exploit	An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c icesanta · mongoose · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	3.6%	Jun 10, 2019
40Plan	CVE-2018-20355No exploit	An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta cesanta · mongoose · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	3.6%	Jun 10, 2019
40Plan	CVE-2018-20356No exploit	An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mcesanta · mongoose · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	3.6%	Jun 10, 2019
40Plan	CVE-2018-20354No exploit	An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Ccesanta · mongoose · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	3.6%	Jun 10, 2019
40Plan	CVE-2017-2892No exploit	An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.cesanta · mongoose · CWE-190 pre-auth RCE Memory safety	Critical9.8	—	3.0%	Nov 7, 2017
40Plan	CVE-2017-2891No exploit	An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8.cesanta · mongoose · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	2.8%	Nov 7, 2017
40Plan	CVE-2017-2922No exploit	An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.cesanta · mongoose · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	2.6%	Nov 7, 2017
40Plan	CVE-2017-2921No exploit	An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.cesanta · mongoose · CWE-190 pre-auth RCE Memory safety	Critical9.8	—	2.4%	Nov 7, 2017
40Plan	CVE-2021-31875No exploit	In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_jcesanta · mongooseos mjs · CWE-193 Pre-auth	Critical9.8	—	2.2%	Apr 28, 2021
40Plan	CVE-2019-12951No exploit	An issue was discovered in Mongoose before 6.15.cesanta · mongoose · CWE-787 Pre-auth Memory safety	Critical9.8	—	2.0%	Jun 24, 2019
40Plan	CVE-2021-27425No exploit	Cesanta Software Mongoose-OS Integer Overflow or Wraparoundcesanta · mongoose os · CWE-190 pre-auth RCE Memory safety	Critical9.8	—	1.7%	May 3, 2022
39Monitor	CVE-2020-25756No exploit	A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking.cesanta · mongoose · CWE-120 Pre-auth Memory safety	Critical9.8	—	1.6%	Sep 18, 2020
39Monitor	CVE-2023-43338No exploit	Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().cesanta · mjs · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Sep 22, 2023
39Monitor	CVE-2023-50044No exploit	Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.cesanta · mjs · CWE-120 Pre-auth Memory safety	Critical9.8	—	0.9%	Dec 20, 2023
39Monitor	CVE-2024-42383No exploit	Use of Out-of-range Pointer Offset in Mongoose Web Server librarycesanta · mongoose · CWE-823 Pre-auth	Critical9.8	—	0.3%	Nov 18, 2024
37Monitor	CVE-2017-2893No exploit	An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.cesanta · mongoose · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	24.9%	Nov 7, 2017
37Monitor	CVE-2018-18765No exploit	An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.cesanta · mongoose · CWE-125 Pre-auth Memory safety	Critical9.1	—	1.8%	Oct 29, 2018
37Monitor	CVE-2018-18764No exploit	An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.cesanta · mongoose · CWE-125 Pre-auth Memory safety	Critical9.1	—	1.8%	Oct 29, 2018
37Monitor	CVE-2026-73251No exploit	Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verificationcesanta · mongoose · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.3%	Aug 20, 2026
36Monitor	CVE-2017-11567Proof of concept	Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of uscesanta · mongoose embedded web server library · CWE-352 pre-auth RCE CSRF	High8.8	—	4.1%	Sep 7, 2017
36Monitor	CVE-2018-20352No exploit	Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earliecesanta · mongoose embedded web server library · CWE-416 pre-auth RCE Memory safety	High8.8	—	2.7%	Jun 10, 2019
36Monitor	CVE-2021-26529No exploit	The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB writecesanta · mongoose · CWE-787 Pre-auth Memory safety	Critical9.1	—	1.5%	Feb 8, 2021
36Monitor	CVE-2021-26528No exploit	The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after excesanta · mongoose · CWE-787 Pre-auth Memory safety	Critical9.1	—	1.5%	Feb 8, 2021

CVE-2019-19307
51Plan
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possib
CriticalCVSS 9.8No exploitEPSS 42%
- Pre-auth
- Memory safety
cesanta · mongooseNov 26, 2019
CVE-2017-2894
48Plan
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
CriticalCVSS 9.8No exploitEPSS 31%
- pre-auth RCE
- Memory safety
cesanta · mongooseNov 7, 2017
CVE-2018-20353
40Plan
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c i
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- Memory safety
cesanta · mongooseJun 10, 2019
CVE-2018-20355
40Plan
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- Memory safety
cesanta · mongooseJun 10, 2019
CVE-2018-20356
40Plan
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta M
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- Memory safety
cesanta · mongooseJun 10, 2019
CVE-2018-20354
40Plan
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in C
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- Memory safety
cesanta · mongooseJun 10, 2019
CVE-2017-2892
40Plan
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
- Memory safety
cesanta · mongooseNov 7, 2017
CVE-2017-2891
40Plan
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8.
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
- Memory safety
cesanta · mongooseNov 7, 2017
CVE-2017-2922
40Plan
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
- Memory safety
cesanta · mongooseNov 7, 2017
CVE-2017-2921
40Plan
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Memory safety
cesanta · mongooseNov 7, 2017
CVE-2021-31875
40Plan
In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_j
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
cesanta · mongooseos mjsApr 28, 2021
CVE-2019-12951
40Plan
An issue was discovered in Mongoose before 6.15.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Memory safety
cesanta · mongooseJun 24, 2019
CVE-2021-27425
40Plan
Cesanta Software Mongoose-OS Integer Overflow or Wraparound
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Memory safety
cesanta · mongoose osMay 3, 2022
CVE-2020-25756
39Monitor
A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Memory safety
cesanta · mongooseSep 18, 2020
CVE-2023-43338
39Monitor
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
cesanta · mjsSep 22, 2023
CVE-2023-50044
39Monitor
Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Memory safety
cesanta · mjsDec 20, 2023
CVE-2024-42383
39Monitor
Use of Out-of-range Pointer Offset in Mongoose Web Server library
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cesanta · mongooseNov 18, 2024
CVE-2017-2893
37Monitor
An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
HighCVSS 7.5No exploitEPSS 25%
- Pre-auth
- Memory safety
- Denial of service
cesanta · mongooseNov 7, 2017
CVE-2018-18765
37Monitor
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.
CriticalCVSS 9.1No exploitEPSS 2%
- Pre-auth
- Memory safety
cesanta · mongooseOct 29, 2018
CVE-2018-18764
37Monitor
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.
CriticalCVSS 9.1No exploitEPSS 2%
- Pre-auth
- Memory safety
cesanta · mongooseOct 29, 2018
CVE-2026-73251
37Monitor
Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
cesanta · mongooseAug 20, 2026
CVE-2017-11567
36Monitor
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of us
HighCVSS 8.8Proof of conceptEPSS 4%
- pre-auth RCE
- CSRF
cesanta · mongoose embedded web server librarySep 7, 2017
CVE-2018-20352
36Monitor
Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlie
HighCVSS 8.8No exploitEPSS 3%
- pre-auth RCE
- Memory safety
cesanta · mongoose embedded web server libraryJun 10, 2019
CVE-2021-26529
36Monitor
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Memory safety
cesanta · mongooseFeb 8, 2021
CVE-2021-26528
36Monitor
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after ex
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Memory safety
cesanta · mongooseFeb 8, 2021