CVE-2022-25299

CVE-2022-25299 affects the cesanta/mongoose package before 7.6. The root cause is unsafe handling of file names during upload via mg_http_upload(), which may allow attackers to write files to arbitrary locations outside the designated target folder. No remediation details are provided in the conn...

CVE-2022-25299 Arbitrary File Write

This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mghttpupload method may enable attackers to write files to arbitrary locations outside the designated target folder...

CVE-2022-25299

Removed by vendor...

CVE-2022-25299

This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mghttpupload method may enable attackers to write files to arbitrary locations outside the designated target folder...

Cesanta Mongoose 安全漏洞

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features for TCP, HTTP clients and servers, and WenSocket clients and servers. A security vulnerability exists in mongoose, which stems from the use of the mg http upload method's insecure handli...

The vulnerability in the implementation of the mm_malloc() function in the Mongoose OS operating system allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the mmmalloc function implementation in the Mongoose OS operating system is related to integer overflow. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

Mongoose Web Server <= 6.8 Multiple Vulnerabilities

Mongoose Web Server is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Mongoose Web Server <= 6.13 Multiple Vulnerabilities

Mongoose Web Server is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview calipso is a Calipso is a simple NodeJS content management system based on Express, Connect & Mongoose. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. It is possible for a malicious module to overwrite files on an arbitrary file...

Unspecified Vulnerability in Cesanta Mongoose

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features such as TCP, HTTP client and server, WenSocket client and server. A security vulnerability exists in Cesanta MongooseOS mJS 1.26, which stems from a maliciously formed JSON string that c...

DNS-Black-Cat(DBC) - Multi Platform Toolkit For An Interactive DNS Shell Commands Exfiltration, By Using DNS-Cat You Will Be Able To Execute System Commands In Shell Mode Over DNS Protocol

Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel. Server ported as a python script, which acts as DNS server with required functionalities to provide interactive shell...

PT-2021-19559 · Cesanta · Mongooseos Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MongooseOS mJS version 1.26 Description: A maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs json parse, potentially leading to redirection of control flow. The original reporter disputes the...

Mongoose-OS 输入验证错误漏洞

Mongoose-OS is an application system. A platform for managing IoT projects. Cesanta Software Mongoose-OS v2.17.0 suffers from an Input Validation Error vulnerability that stems from incorrect memory allocation could lead to arbitrary memory allocation, which could result in unexpected behavior su...

Cesanta Mongoose 缓冲区错误漏洞

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features such as TCP, HTTP client and server, WenSocket client and server. A security vulnerability exists in Cesanta MongooseOS mJS 1.26, which stems from a maliciously formed JSON string that c...

Prototype Pollution

mongoose is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution in automattic/mongoose

✍️ Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Mongoose supports both promises and callbacks. mongoose.Schema is subject to prototype pollution due to the recursively calling of Schema.prototype.add function to add new items into the...

Mongoose Web Server < 7.1 Multiple Vulnerabilities

Mongoose Web Server is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Cesanta Mongoose out-of-bounds write vulnerability (CNVD-2021-12086)

Mongoose is a C/C++ network library. An out-of-bounds write vulnerability exists in the mgtlsinit function in Cesanta Mongoose 7.0, 6.7-6.18. An attacker can exploit this vulnerability via a connection request to cause an out-of-bounds write after the memory pool is exhausted...

Cesanta Mongoose Out-of-Bounds Write Vulnerability

Mongoose is a C/C++ network library. An out-of-bounds write vulnerability exists in the mgtlsinit function in Cesanta Mongoose 7.0. An attacker can exploit this vulnerability via a connection request to cause an out-of-bounds write after the memory pool is exhausted...

Cesanta Mongoose out-of-bounds write vulnerability (CNVD-2021-12087)

Mongoose is a C/C++ network library. An out-of-bounds write vulnerability exists in the mghttpservefile function in Cesanta Mongoose 7.0. An attacker can exploit this vulnerability via a connection request to cause an out-of-bounds write after the memory pool is exhausted...