PT-2019-10054

Name of the Vulnerable Software and Affected Versions: Cesanta Mongoose Embedded Web Server Library versions 6.13 and earlier Description: The issue is caused by a use-after-free vulnerability in the mg http get proto data function, which can lead to a denial of service or remote code execution...

PT-2019-10057

Name of the Vulnerable Software and Affected Versions: Cesanta Mongoose Embedded Web Server Library versions 6.13 and earlier Description: The issue is caused by a use-after-free vulnerability in the mg http free proto data cgi function call in mongoose.c, allowing for an invalid read of 8 bytes...

PT-2019-10056

Name of the Vulnerable Software and Affected Versions: Cesanta Mongoose Embedded Web Server Library versions 6.13 and earlier Description: The issue is caused by a use-after-free vulnerability in the mg http free proto data cgi function call in mongoose.c, which can lead to an invalid write of 8...

PT-2018-15014

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.13 Description A SIGSEGV issue exists in the mg mqtt add session function, located in mongoose.c. Recommendations For Cesanta Mongoose version 6.13, consider disabling the mg mqtt add session function as a temporary...

PT-2018-14637

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.13 Description A memory read issue exists in the MQTT packet-parsing functionality, specifically a heap-based buffer over-read in mg mqtt next subscribe topic. This can be triggered by a specially crafted MQTT...

portal.camposgerais.mg.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-640483 Description| Value ---|--- Affected Website:| portal.camposgerais.mg.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mongoose Denial of Service Vulnerability

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features such as TCP, HTTP client and server, WenSocket client and server. A security vulnerability exists in the 'mghandlecgi' function of the mongoose.c file in Cesanta Mongoose version 6.11. A...

PT-2018-10201

Name of the Vulnerable Software and Affected Versions Mongoose version 6.11 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, or a NULL pointer dereference, via an HTTP request. This is related to the mbuf...

CVE-2017-10897

Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to cause the device to become unresponsive via unspecified vectors...

PT-2017-12104

Name of the Vulnerable Software and Affected Versions Mongoose Web Server versions prior to 6.9 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that modify Mongoose.conf via a request to " mg admin?save". This can be leveraged...

PT-2017-17564

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose Embedded Web Server Library versions 6.7 and earlier Mongoose OS versions 1.2 and earlier Description The issue is related to a use-after-free vulnerability in the mg http multipart wait for boundary function. This vulnerabili...

mg-cars.be Open Redirect vulnerability

Vulnerable URL: http://www.mg-cars.be/Svh1bbe55rg4ycwf4isjnsc55/Site/SetCulture.aspx?culture=fr-FR=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 08:26 GMT Vulnerability type:| Open Redirect Vulnerability status:...

Trust Management Vulnerabilities in Multiple GE Products (CNVD-2015-05132)

GE Healthcare Millennium MG, NC and MyoSIGHT are General Electric GE scanning camera products for the healthcare industry. A security vulnerability exists in multiple GE products that stems from the use of 'insite.genieacq' which cannot be changed unless the program disables remote InSite-support...

Trust Management Vulnerabilities in Multiple GE Products (CNVD-2015-05133)

GE Healthcare Millennium MG, NC and MyoSIGHT are General Electric GE scanning camera products for the healthcare industry. The security vulnerability in several GE products stems from the program's use of default passwords username: root password: root.genie, username: service password: service.,...

CVE-2002-2446

GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors...

CVE-2002-2445

GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of 1 root.genie for the root user, 2 "service." for the service user, 3 admin.genie for the admin user, 4 reboot for the reboot user, and 5 shutdown for the shutdown user, which has unspecified impact and attack vectors...

CVE-2002-2446

The CVE-2002-2446 issue affects GE Healthcare Millennium MG / NC / MyoSIGHT (and related GE imaging systems) due to default or hard-coded credentials: the insite.genieacq password cannot be changed without disabling remote InSite support. This enables potential remote authentication bypass on aff...

CVE-2002-2445

CVE-2002-2445 affects GE Healthcare Millennium MG, NC, and MyoSIGHT. The vulnerability stems from the use of default passwords for multiple accounts (root.genie, service., admin.genie, reboot, shutdown). According to connected CNVD-2015-05133, an attacker could exploit these defaults to take cont...

PT-2015-3457

Name of the Vulnerable Software and Affected Versions GE Healthcare Millennium MG, NC, and MyoSIGHT affected versions not specified Description The issue concerns default passwords for various user accounts, including root.genie for the root user, service. for the service user, admin.genie for th...

CVE-2002-2446: Undefined Security Weakness

GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors...