Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
284 results · page 2 of 6
May 26, 2025Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS BluCVE-2025-35003 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0.
- Product
- Apache NuttX RTOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Apr 2, 2025An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-50597 · Other software · STMicroelectronics · reported by talos-cna@cisco.comMedium 4.3
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 2, 2025An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-50596 · Other software · STMicroelectronics · reported by talos-cna@cisco.comMedium 4.3
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 2, 2025An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-50595 · Other software · STMicroelectronics · reported by talos-cna@cisco.comMedium 4.3
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 2, 2025An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-50594 · Other software · STMicroelectronics · reported by talos-cna@cisco.comMedium 4.3
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 2, 2025A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-50385 · Other software · STMicroelectronics · reported by talos-cna@cisco.comMedium 6.5
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 2, 2025A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-50384 · Other software · STMicroelectronics · reported by talos-cna@cisco.comMedium 6.5
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Web Component HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 2, 2025A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.CVE-2024-45064 · Other software · STMicroelectronics · reported by talos-cna@cisco.comHigh 8.5
A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set of network packets can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- X-CUBE-AZRT-H7RS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Mar 19, 2025SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone imageCVE-2025-30234 · Other software · MNX · reported by MITREHigh 8.3
SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone image from 2024-07-26).
- Product
- SmartOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tritondatacenter.comsmartos.topicbox.com
Feb 25, 2025The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough tCVE-2025-1675 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.CVE-2025-1674 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.CVE-2025-1673 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025No proper validation of the length of user input in http_server_get_content_type_from_extension.CVE-2024-10395 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
No proper validation of the length of user input in http_server_get_content_type_from_extension.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2024No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.CVE-2024-8798 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.5
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is CVE-2024-11263 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.3
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.CVE-2024-6444 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.CVE-2024-6443 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.CVE-2024-6442 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT: HCI: adv_ext_report Improper discarding in adv_ext_reportCVE-2024-6259 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT: Classic: SDP OOB access in get_att_search_listCVE-2024-6137 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
BT: Classic: SDP OOB access in get_att_search_list
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT:Classic: Multiple missing buf length checksCVE-2024-6135 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
BT:Classic: Multiple missing buf length checks
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT: Unchecked user input in bap_broadcast_assistantCVE-2024-5931 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
BT: Unchecked user input in bap_broadcast_assistant
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT: Missing length checks of net_buf in rfcomm_handle_dataCVE-2024-6258 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
BT: Missing length checks of net_buf in rfcomm_handle_data
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT: Encryption procedure host vulnerabilityCVE-2024-5754 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
BT: Encryption procedure host vulnerability
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2024BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by ZeroCVE-2024-4785 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the ICVE-2024-31970 · Other software · adtran · reported by MITREHigh 8.8
AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with root-level privileges. An attacker can exploit this window to gain unauthorized root access by either modifying the existing admin account or creating a new account with equivalent privileges. This vulnerability allows attackers to execute arbitrary commands. NOTE: The vendor has disputed this, finding the report not applicable. According to AdTran, SSH has never been accessible (from WAN) on SmartOS official builds. Furthermore, the vendor adds that test build 11.1.0.101-202106231430 was never released to end users.
- Product
- 834-5_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose passwoCVE-2024-39345 · Other software · adtran · reported by MITREHigh 7.2
AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose password is based on the devices MAC address. All of the devices internet interfaces share a similar MAC address that only varies in their final octet. This allows network-adjacent attackers to derive the support user's SSH password by decrementing the final octet of the connected gateway address or via the BSSID. An attacker can then execute arbitrary OS commands with root-level privileges. NOTE: The vendor states that there is no intended functionality allowing an attacker to execute arbitrary OS Commands with root-level privileges. The vendor also states that this issue was fixed in SmartOS 12.5.5.1.
- Product
- 834-5_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or TraceCVE-2024-31977 · Other software · adtran · reported by MITREHigh 8.8
Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.
- Product
- 834-5_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.megithub.com
Jul 10, 2024A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38.CVE-2016-15039 · Other software · mhuertos · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523.
- Product
- phpLDAPadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2024A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE deviceCVE-2024-3332 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.5
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019.CVE-2024-34400 · Other software · reported by MITREMedium 6.1
An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. There is /_layouts/15/Virto.KanbanTaskManager/api/KanbanData.ashx LinkTitle2 XSS.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.virtosoftware.comdownload.virtosoftware.com
Jun 24, 2024FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS.CVE-2024-38373 · Other software · FreeRTOS · reported by GitHubCritical 9.6
FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.
- Product
- FreeRTOS-Plus-TCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019.CVE-2024-33881 · Other software · virtosoftware · reported by MITREMedium 5.3
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.
- Product
- virto_bulk_file_download
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.virtosoftware.comdownload.virtosoftware.com
Jun 24, 2024An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019.CVE-2024-33880 · Email & office · Virtosoftware · reported by MITREMedium 5.3
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive.
- Product
- Sharepoint Bulk File Download
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.virtosoftware.comdownload.virtosoftware.com
Jun 24, 2024An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019.CVE-2024-33879 · Other software · virtosoftware · reported by MITRECritical 9.8
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter.
- Product
- virto_bulk_file_download
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.virtosoftware.comdownload.virtosoftware.com
Mar 29, 2024An malicious BLE device can crash BLE victim device by sending malformed gatt packetCVE-2024-3077 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeRTCVE-2024-2212 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.3
In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c) were missing parameter checks. This could lead to integer wraparound, under-allocations and heap buffer overflows.
- Product
- ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Mar 15, 2024Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination addrCVE-2023-7060 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024FreeRTOS is a real-time operating system for microcontrollers.CVE-2024-28115 · Other software · FreeRTOS · reported by GitHubHigh 8.8
FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.
- Product
- FreeRTOS-Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Possible buffer overflow in is_mount_pointCVE-2023-6881 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.3
Possible buffer overflow in is_mount_point
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission CVE-2024-1638 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Signed to unsigned conversion esp32_ipm_sendCVE-2023-6249 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8
Signed to unsigned conversion esp32_ipm_send
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024can: out of bounds in remove_rx_filter functionCVE-2023-5779 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.4
can: out of bounds in remove_rx_filter function
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Unchecked length coming from user input in settings shellCVE-2023-6749 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8
Unchecked length coming from user input in settings shell
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2023-48698 · Other software · azure-rtos · reported by GitHubMedium 6.8
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host classes, related to device linked classes, GSER and HID in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2023-48697 · Other software · azure-rtos · reported by GitHubMedium 6.4
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in pictbridge and host class, related to PIMA, storage, CDC ACM, ECM, audio, hub in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2023-48696 · Other software · azure-rtos · reported by GitHubMedium 6.7
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2023-48695 · Other software · azure-rtos · reported by GitHubHigh 7.3
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and device classes, related to CDC ECM and RNDIS in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2023-48694 · Other software · azure-rtos · reported by GitHubMedium 6.8
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications.CVE-2023-48693 · Other software · azure-rtos · reported by GitHubHigh 8.7
Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The affected components include RTOS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- threadx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.