Embedthis vulnerabilities, page 2
26 vulnerabilities
Known vulnerabilities in Embedthis products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
CVE-2019-16645embedthisgoahead
EPSS score8.18%
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.CVE-2019-19240embedthisgoaheadEPSS score1.54%
Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response.CVE-2019-5096embedthisgoaheadEPSS score66.98%
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.CVE-2019-5097embedthisgoaheadEPSS score45.06%
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.CVE-2019-12822embedthisgoaheadEPSS score8.85%
In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and potential DoS, as demonstrated by a colon on a line by itself.CVE-2023-53155embedthisgoaheadEPSS score0.57%
goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.