CVE-2017-11567

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

CVE-2017-11567

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

CVE-2017-11567

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

CVE-2017-11567

CVE-2017-11567 concerns the Mongoose Web Server (Free Edition) where a CSRF vulnerability exists in versions before 6.9. The issue allows remote attackers to hijack user authentication to perform requests that modify Mongoose.conf via a request to __mg_admin?save, and this note states it can be l...

CVE-2017-11567: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to mgadmin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely...

PT-2017-12104

Name of the Vulnerable Software and Affected Versions Mongoose Web Server versions prior to 6.9 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that modify Mongoose.conf via a request to " mg admin?save". This can be leveraged...

Mongoose Web Server Cross-Site Request Forgery Vulnerability

Mongoose Web Server is a WEB service program. A cross-site request forgery vulnerability exists in Mongoose Web Server because the application fails to properly validate HTTP requests. A remote attacker could be allowed to exploit the vulnerability to perform certain unauthorized actions and acce...

Mongoose Web Server 6.5 CSRF / Command Execution Vulnerability

Mongoose Web Server version 6.5 suffers from cross site request forgery and remote command execution vulnerabilities. + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt +...

Mongoose Web Server 6.5 CSRF / Command Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt + ISR: apparitionSec Vendor: =============== www.cesanta.com Product: ================== Mongoose Web Server Free Edition...

Mongoose Web Server 6.5 - Cross-Site Request Forgery Remote Code Execution

Mongoose Web Server 6.5 - Cross-Site Request Forgery Remote Code Execution + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt + ISR: apparitionSec Vendor: ===============...

Mongoose Web Server 6.5 - Cross-Site Request Forgery / Remote Code Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt + ISR: apparitionSec Vendor: =============== www.cesanta.com Product: ================== Mongoose Web Server Free Edition...

Cesanta Mongoose Embedded Web Server Library and Mongoose OS Memory Misreference Vulnerability

Cesanta Mongoose Embedded Web Server Library and Mongoose OS are both products of the American company Cesanta. The former is a web library for embedded web servers; the latter is an open source operating system for the Internet of Things. A memory misreference exists in the...

CVE-2017-7185

Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...

CVE-2017-7185

Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...

CVE-2017-7185

Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...

CVE-2017-7185

CVE-2017-7185 is a use-after-free in Cesanta’s Mongoose Embedded Web Server Library (mg_http_multipart_wait_for_boundary) affecting versions<=6.7 and Mongoose OS

CVE-2017-7185

Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...

CVE-2017-7185: Use After Free

Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...

PT-2017-17564

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose Embedded Web Server Library versions 6.7 and earlier Mongoose OS versions 1.2 and earlier Description The issue is related to a use-after-free vulnerability in the mg http multipart wait for boundary function. This vulnerabili...