Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
284 results · page 3 of 6
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48692 · Other software · azure-rtos · reported by GitHubCritical 9
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48691 · Other software · azure-rtos · reported by GitHubHigh 8.1
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48316 · Other software · azure-rtos · reported by GitHubCritical 9.8
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to snmp, smtp, ftp and dtls in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48315 · Other software · azure-rtos · reported by GitHubHigh 8.8
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to ftp and sntp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.CVE-2023-5055 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.3
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow CVE-2021-27504 · Other software · Texas Instruments · reported by ics-cert@hq.dhs.govHigh 7.4
Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution.
- Product
- CC32XX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which canCVE-2021-27502 · Other software · Texas Instruments · reported by ics-cert@hq.dhs.govHigh 7.4
Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.
- Product
- CC32XX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the vicCVE-2023-4424 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.3
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023 Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values.CVE-2021-27429 · Other software · Texas Instruments · reported by ics-cert@hq.dhs.govHigh 7.4
Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution.
- Product
- CC32XX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023 Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, whicCVE-2021-22636 · Other software · Texas Instruments · reported by ics-cert@hq.dhs.govHigh 7.4
Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.
- Product
- CC32XX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driverCVE-2023-5139 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.4
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 25, 2023Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.cCVE-2023-5753 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 13, 2023Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.CVE-2023-4257 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 13, 2023Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverCVE-2023-4263 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 12, 2023The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y.CVE-2023-5563 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.1
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2023-36418 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 6, 2023Potential buffer overflow vulnerability in the Zephyr CAN bus subsystemCVE-2023-3725 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 27, 2023Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.CVE-2023-5184 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7
Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 27, 2023Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.CVE-2023-4264 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.1
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 27, 2023Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.CVE-2023-4260 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 25, 2023Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.CVE-2023-4259 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.1
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 25, 2023In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionCVE-2023-4258 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2023Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_pCVE-2023-4265 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.4
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 10, 2023Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.CVE-2023-2234 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cCVE-2023-1902 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 5.9
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller CVE-2023-1901 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 5.9
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A missing nullptr-check in handle_ra_input can cause a nullptr-deref.CVE-2023-0359 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 5.9
A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation isCVE-2023-0779 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.7
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2023Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stackCVE-2021-3329 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.6
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzephyrprojectsec.atlassian.netzephyrprojectsec.atlassian.net
Jan 24, 2023A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.CVE-2023-0396 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2023Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.CVE-2022-3806 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.8
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.CVE-2023-0397 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.6
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.CVE-2021-3966 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.6
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023There is no check to see if slot 0 is being uploaded from the device to the host.CVE-2022-0553 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.5
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 2CVE-2021-43395 · Other software · Illumos · reported by MITREMedium 5.5
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unprivileged user can cause a deadlock and kernel panic via crafted rename and rmdir calls on tmpfs filesystems. Oracle Solaris 10 and 11 is also affected.
- Product
- Illumos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtribblix.orggithub.com
Dec 9, 2022There is an error in the condition of the last if-statement in the function smp_check_keys.CVE-2022-2993 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-41051 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 8, 2022Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX.CVE-2022-39343 · Other software · azure-rtos · reported by GitHubMedium 5.6
Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.
- Product
- filex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2022-39344 · Other software · azure-rtos · reported by GitHubCritical 9.8
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function prevents buffer overflow during handling of DFU UPLOAD command when current state is `UX_SYSTEM_DFU_STATE_DFU_IDLE`. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the `UPLOAD_LENGTH` check in all possible states.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node.CVE-2022-2741 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2022-39293 · Other software · azure-rtos · reported by GitHubHigh 8.6
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in [_ux_host_class_pima_read](https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_pima_read.c), there is data length from device response, returned in the very first packet, and read by [L165 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L165), as header_length. Then in [L178 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L178), there is a “if” branch, which check the expression of “(header_length - UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE) > data_length” where if header_length is smaller than UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE, calculation could overflow and then [L182 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L182) the calculation of data_length is also overflow, this way the later [while loop start from L192
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supCVE-2022-36063 · Other software · azure-rtos · reported by GitHubHigh 7.6
Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integer underflow and a buffer overflow in the `_ux_host_class_cdc_ecm_mac_address_get` function which may be potentially exploited to achieve remote code execution or denial of service. Setting mac address string descriptor length to a `0` or `1` allows an attacker to introduce an integer underflow followed (string_length) by a buffer overflow of the `cdc_ecm -> ux_host_class_cdc_ecm_node_id` array. This may allow one to redirect the code execution flow or introduce a denial of service. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). Improved mac address string descriptor length validation to check for unexpectedly small values may be used as a workaround.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.CVE-2022-1841 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.2
In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-35806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-35779 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-35773 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-34687 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Information Disclosure VulnerabilityCVE-2022-34686 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Azure RTOS GUIX Studio Information Disclosure Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Information Disclosure VulnerabilityCVE-2022-34685 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Azure RTOS GUIX Studio Information Disclosure Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30176 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.