Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
146 results · page 2 of 3
May 6, 2026A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7.CVE-2026-8031 · Other software · PicoTronica · reported by VulDBMedium 5.5
A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/patient-records of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 5.7.1 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- e-Clinic Healthcare System ECHS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Apr 25, 2026A vulnerability was detected in PicoClaw up to 0.2.4.CVE-2026-6987 · Other software · Sipeed · reported by VulDBMedium 5.5
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Picoclaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Picomatch is a glob matcher written JavaScript.CVE-2026-33672 · Other software · micromatch · reported by GitHubMedium 5.3
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns
- Product
- picomatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Picomatch is a glob matcher written JavaScript.CVE-2026-33671 · Other software · micromatch · reported by GitHubHigh 7.5
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob:
- Product
- picomatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Apicona: Deserialization of Untrusted DataCVE-2026-25400 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
- Product
- Apicona
- Affected
- up to 24.1.0
- What to do
- Affects up to 24.1.0. Update Apicona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 17, 2026OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unseCVE-2026-27522 · Other software · OpenClaw · reported by VulnCheckHigh 7.1
OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2026KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potentially execute arbitraCVE-2020-36935 · Other software · KMSpico · reported by VulnCheckHigh 8.5
KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in C:\Program Files\KMSpico\Service_KMS.exe to inject malicious executables and escalate privileges.
- Product
- Service KMSELDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordofficial-kmspico.comexploit-db.com
Apr 28, 2025The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack.CVE-2025-32472 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type attack, causing the web page to become unresponsive.
- Product
- SICK multiScan1XX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024.CVE-2025-22953 · Other software · Epicor · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution.
- Product
- Human Capital Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtinted-hollyhock-92d.notion.site
Mar 6, 2025A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232.CVE-2024-42844 · Other software · reported by MITREHigh 8.1
A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on thCVE-2025-24946 · Other software · privateoctopus · reported by MITREMedium 5.3
The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).
- Product
- picoquic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Picotls is a TLS protocol library that allows users select different crypto backends based on their use case.CVE-2024-45402 · Other software · h2o · reported by GitHubHigh 8.6
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurs during the disposal of multiple objects without any intervening calls to malloc Typically, this triggers the malloc implementation to detect the error and abort the process. However, depending on the internals of malloc and the crypto backend being used, the flaw could potentially lead to a use-after-free scenario, which might allow for arbitrary code execution. The vulnerability is addressed with commit 9b88159ce763d680e4a13b6e8f3171ae923a535d.
- Product
- picotls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token valiCVE-2024-8642 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.1
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
- Product
- Eclipse EDC Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43995 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2024route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.CVE-2024-22087 · Websites & servers · Alekseykurepin · reported by MITRECritical 9.8
route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.
- Product
- Pico Http Server IN C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In PicoTCP 1.7.0, TCP ISNs are improperly random.CVE-2020-27635 · Other software · Capgemini · reported by MITRECritical 9.1
In PicoTCP 1.7.0, TCP ISNs are improperly random.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2023FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attributeCVE-2023-38802 · Other software · Frrouting · reported by MITREHigh 7.5
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
- Product
- Frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.benjojo.co.uklists.debian.org
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.CVE-2023-35849 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.CVE-2023-35848 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).CVE-2023-35847 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performing port filtering.CVE-2023-35846 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performing port filtering.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer overflow in pico_ipv6_alloc when processing largeCVE-2023-30463 · Other software · Altran · reported by MITREHigh 7.5
Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer overflow in pico_ipv6_alloc when processing large ICMPv6 packets. This affects installations with Ethernet support in which a packet size greater than 65495 may occur.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic.CVE-2016-15029 · Other software · Ydalb · reported by VulDBLow 3.5
A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.10.0 is able to address this issue. The patch is identified as 67e87f0f0c1ac238fcd050f4c3db298229bc9679. It is recommended to upgrade the affected component. VDB-223402 is the identifier assigned to this vulnerability.
- Product
- mapicoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemble, allows attackerCVE-2021-33304 · Other software · Altran · reported by MITRECritical 9.8
Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemble, allows attackers to execute arbitrary code.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the devCVE-2021-34577 · Other software · Kaden · reported by info@cert.vde.comMedium 6.5
In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.
- Product
- PICOFLUX AiR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfit.vutbr.czfit.vutbr.cz
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken.CVE-2022-44321 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCVE-2022-44320 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctioCVE-2022-44319 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCaCVE-2022-44318 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCalCVE-2022-44317 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.CVE-2022-44316 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCaCVE-2022-44315 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCCVE-2022-44314 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionCVE-2022-44313 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOpeCVE-2022-44312 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOperator.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting iCVE-2022-41224 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.CVE-2022-34556 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists.CVE-2021-34576 · Other software · Kaden · reported by info@cert.vde.comMedium 4.3
In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive information (water consumption without distinct values) to third parties.
- Product
- PICOFLUX AiR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfit.vutbr.czfit.vutbr.cz
Sep 9, 2021Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon CCVE-2021-1956 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Apr 18, 2021This affects all versions of package picotts.CVE-2021-23378 · Other software · Picotts Project · reported by report@snyk.ioCritical 9.8
This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
- Product
- Picotts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the picoquic_decode_framesCVE-2020-24944 · Other software · Privateoctopus · reported by MITREHigh 7.5
picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the picoquic_decode_frames and picoquic_decode_stream_frame functions and epoch==3.
- Product
- Picoquic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020An issue was discovered in picoTCP and picoTCP-NG through 1.7.0.CVE-2020-24341 · Other software · Altran · reported by MITRECritical 9.1
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP and picoTCP-NG through 1.7.0.CVE-2020-24340 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_handle_data_as_answers_generic() in pico_mdns.c does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the packet, leading to an out-of-bounds read, invalid pointer dereference, and Denial-of-Service.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP and picoTCP-NG through 1.7.0.CVE-2020-24339 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pico_dns_common.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds reads that lead to Denial-of-Service.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP through 1.7.0.CVE-2020-24338 · Other software · Altran · reported by MITRECritical 9.8
An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pico_dns_common.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writes that lead to Denial-of-Service and Remote Code Execution.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP and picoTCP-NG through 1.7.0.CVE-2020-24337 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming TCP packet, it is possible to cause a Denial-of-Service by achieving an infinite loop in the code that parses TCP options, aka tcp_parse_options() in pico_tcp.c.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP 1.7.0.CVE-2020-17445 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 destination options does not check for a valid length of the destination options header. This results in an Out-of-Bounds Read, and, depending on the memory protection mechanism, this may result in Denial-of-Service in pico_ipv6_process_destopt() in pico_ipv6.c.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP 1.7.0.CVE-2020-17444 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv6 extension headers are valid) doesn't check whether the header extension length field would overflow. Therefore, if it wraps around to zero, iterating through the extension headers will not increment the current data pointer. This leads to an infinite loop and Denial-of-Service in pico_ipv6_check_headers_sequence() in pico_ipv6.c.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP 1.7.0.CVE-2020-17443 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this, the operation that calculates the size of the ICMPv6 echo replies has an integer wrap around, leading to memory corruption and, eventually, Denial-of-Service in pico_icmp6_send_echoreply_not_frag in pico_icmp6.c.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in picoTCP 1.7.0.CVE-2020-17442 · Other software · Altran · reported by MITREHigh 7.5
An issue was discovered in picoTCP 1.7.0. The code for parsing the hop-by-hop IPv6 extension headers does not validate the bounds of the extension header length value, which may result in Integer Wraparound. Therefore, a crafted extension header length value may cause Denial-of-Service because it affects the loop in which the extension headers are parsed in pico_ipv6_process_hopbyhop() in pico_ipv6.c.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.