Browse CVEs

CRITICAL 9.8 CVE-2021-41615 websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise valu… Goahead Mitigation only Fix from $2,3002022-08-08 HIGH 7.5 CVE-2021-33254 An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stre… Appweb Patch available Fix from $1,9502022-06-02 CRITICAL 9.8 CVE-2021-43298 The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This me… Goahead 5.1.4+ Fix from $2,3002022-01-25 CRITICAL 9.8 CVE-2021-42342EPSS 59% An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without bein… Goahead 5.1.5+ Fix from $2,3002021-10-14 HIGH 8.8 CVE-2020-15688 The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthentica… Goahead 5.1.2+ Fix from $1,9502020-07-23 HIGH 7.5 CVE-2020-15689 Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This… Appweb 7.2.2 / 8.1.0+ Fix from $1,9502020-07-13 CRITICAL 9.8 CVE-2019-5096EPSS 67% An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application … Goahead No fix yet Fix from $2,3002019-12-03 HIGH 7.5 CVE-2019-5097EPSS 45% A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5… Goahead No fix yet Fix from $1,9502019-12-03 MEDIUM 5.3 CVE-2019-19240 Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that … Goahead 5.0.1+ Fix from $1,6002019-11-22 HIGH 8.6 CVE-2019-16645EPSS 8% An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostna… Goahead No fix yet Fix from $1,9502019-09-20 HIGH 7.5 CVE-2019-12822EPSS 9% In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory refe… Goahead 4.1.1 / 5.0.1+ Fix from $1,9502019-06-14 HIGH 7.5 CVE-2018-15504 An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with tim… Appweb 4.0.1 / 7.0.2+ Fix from $1,9502018-08-18 HIGH 7.5 CVE-2018-15505 An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field … Appweb 4.0.1 / 7.0.2+ Fix from $1,9502018-08-18 HIGH 8.1 CVE-2018-8715EPSS 23% The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forge… Appweb after 7.0.2 Fix from $1,9502018-03-15 CRITICAL 9.8 CVE-2017-1000471EPSS 9% EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of … Goahead Patch available Fix from $2,3002018-01-03 HIGH 7.5 CVE-2017-1000470EPSS 8% EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service. Goahead Web Server Patch available Fix from $1,9502018-01-03 HIGH 8.1 CVE-2017-17562 KEVEPSS 96% Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializi… Goahead 3.6.5+ Fix from $1,9502017-12-12 HIGH 7.5 CVE-2017-14149EPSS 6% GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" reques… Goahead No fix yet Fix from $1,9502017-09-05 CRITICAL 9.8 CVE-2017-5674EPSS 22% A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft … Goahead No fix yet Fix from $2,3002017-03-13 HIGH 8.8 CVE-2017-5675 A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label… Goahead No fix yet Fix from $1,9502017-03-13 HIGH 7.5 CVE-2014-9707EPSS 28% EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct direct… Goahead Patch available Fix from $1,9502015-03-31