EM
Vendor
Embedthis
28
CVEs
1
On KEV
0
New 30D
Products
GO9.8
GoAhead
Embedthis
21 CVEs1 on KEV0 new
AP8.1
Appweb
Embedthis
6 CVEs0 on KEV0 new
GW7.5
Goahead Web Server
Embedthis
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-53155 | GO GoAhead EmbedThis | 7.2 | Jul 25 | goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter |
| CVE-2024-3187 | GO GoAhead EmbedThis | 5.9 | Oct 17 | This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0 |
| CVE-2024-3186 | GO GoAhead EmbedThis | 5.3 | Oct 17 | CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT flag |
| CVE-2024-3184 | GO GoAhead EmbedThis | 5.9 | Oct 17 | Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC flag |
| CVE-2021-41615 | GO Goahead Embedthis | 9.8 | Aug 8 | websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the… |
| CVE-2021-33254 | AP Appweb Embedthis | 7.5 | Jun 2 | An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri… |
| CVE-2021-43298 | GO Goahead Embedthis | 9.8 | Jan 25 | The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting |
| CVE-2021-42342 | GO Goahead Embedthis | 9.8 | Oct 14 | An issue was discovered in GoAhead 4.x and 5.x before 5.1.5 |
| CVE-2020-15688 | GO Goahead Embedthis | 8.8 | Jul 23 | The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks |
| CVE-2020-15689 | AP Appweb Embedthis | 7.5 | Jul 13 | Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range |
| CVE-2019-5097 | GO Goahead Embedthis | 7.5 | Dec 3 | A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5 |
| CVE-2019-5096 | GO Goahead Embedthis | 9.8 | Dec 3 | An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1… |
| CVE-2019-19240 | GO Goahead Embedthis | 5.3 | Nov 22 | Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header |
| CVE-2019-16645 | GO Goahead Embedthis | 8.6 | Sep 20 | An issue was discovered in Embedthis GoAhead 2.5.0 |
| CVE-2019-12822 | GO Goahead Embedthis | 7.5 | Jun 14 | In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and potential DoS, as… |
| CVE-2018-15505 | AP Appweb Embedthis | 7.5 | Aug 18 | An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2 |
| CVE-2018-15504 | AP Appweb Embedthis | 7.5 | Aug 18 | An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2 |
| CVE-2018-8715 | AP Appweb Embedthis | 8.1 | Mar 15 | The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c |
| CVE-2017-1000471 | GO Goahead Embedthis | 9.8 | Jan 3 | EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service |
| CVE-2017-1000470 | GW Goahead Web Server Embedthis | 7.5 | Jan 3 | EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service |
| CVE-2017-17562 In wildKEV | GO Goahead Embedthis | 8.1 | Dec 12 | Embedthis GoAhead Remote Code Execution Vulnerability |
| CVE-2017-14149 | GO Goahead Embedthis | 7.5 | Sep 5 | GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request |
| CVE-2017-5675 | GO Goahead Embedthis | 8.8 | Mar 13 | A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models |
| CVE-2017-5674 | GO Goahead Embedthis | 9.8 | Mar 13 | A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET… |
| CVE-2014-9708 | AP Appweb Embedthis | – | Mar 31 | Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as… |
| CVE-2014-9707 | GO Goahead Embedthis | – | Mar 31 | EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a |