Approved changes feed: RSS · Atom
cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Embedthis (3645b664-79bb-5f0b-b706-619126e3cef7) |
|---|---|
| Product | Goahead (0f251e4a-da4d-53e9-a8b2-32638ff738b1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/embedthis/goahead |
purl2cpe | 2026-06-01 10:11:27.086860 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-3187 |
vulnerable | 2026-06-08 06:41:52.658823 |
Details available
MEDIUM (5.9)
This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the ME_GOAHEAD_JAVASCRIPT flag is enabled, a remote attacker with the privileges to modify JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption, potentially causing a Denial of Service (DoS) or, in rare cases, code execution, though the latter is highly context-dependent.
Published: 2024-10-17T07:34:50.960Z
Updated: 2024-10-17T14:40:42.458Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3186 |
vulnerable | 2026-06-08 06:41:52.658500 |
Details available
MEDIUM (5.3)
CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript template (JST) files to trigger a crash and cause a Denial of Service (DoS) by providing malicious templates.
Published: 2024-10-17T07:34:37.433Z
Updated: 2024-10-17T14:41:27.052Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3184 |
vulnerable | 2026-06-08 06:41:52.655815 |
Details available
MEDIUM (5.9)
Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC flag. Without a memory notifier for allocation failures, remote attackers can exploit these vulnerabilities by sending malicious requests, leading to a crash and Denial of Service (DoS).
Published: 2024-10-17T07:32:18.369Z
Updated: 2024-10-17T14:42:12.325Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-53155 |
vulnerable | 2026-06-08 06:17:56.306581 |
Details available
HIGH (7.2)
goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.
Published: 2025-07-25T00:00:00.000Z
Updated: 2025-07-29T13:54:12.010Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43298 |
vulnerable | 2026-06-08 05:36:43.115541 |
Details available
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
Published: 2022-01-25T19:11:17.000Z
Updated: 2024-08-04T03:55:28.938Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-42342 |
vulnerable | 2026-06-08 05:35:22.203312 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15688 |
vulnerable | 2026-06-08 05:19:26.342096 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19240 |
vulnerable | 2026-06-08 05:13:21.773578 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12822 |
vulnerable | 2026-06-08 05:12:40.538222 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-15505 |
vulnerable | 2026-06-08 05:10:54.842491 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-15504 |
vulnerable | 2026-06-08 05:10:54.576069 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-17562 |
vulnerable | 2026-06-08 05:09:09.596499 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.