Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Sep 5, 2021In Contiki 3.0, Telnet option negotiation is mishandled.CVE-2021-40523 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of service. Specifically, a server sometimes sends no response, because a fixed buffer space is available for all responses and that space may have been exhausted.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting foreverCVE-2021-38387 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting forever, which may cause excessive CPU consumption.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a directoCVE-2021-38386 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a directory has many files with long names.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service.CVE-2021-38311 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessive CPU consumption.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021An issue was discovered in Contiki through 3.0.CVE-2021-28362 · Other software · Contiki-os · reported by MITREHigh 7.5
An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage, and these variables are susceptible to integer underflow, it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020An issue was discovered in the IPv6 stack in Contiki through 3.0.CVE-2020-25112 · Other software · Contiki-os · reported by MITRECritical 9.8
An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.
- Product
- Contiki-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in the IPv6 stack in Contiki through 3.0.CVE-2020-25111 · Other software · Contiki-os · reported by MITRECritical 9.8
An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.
- Product
- Contiki-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in Contiki through 3.0.CVE-2020-13986 · Other software · Contiki-os · reported by MITREHigh 7.5
An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when handling RPL extension headers of IPv6 network packets in rpl_remove_header in net/rpl/rpl-ext-header.c.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in Contiki through 3.0.CVE-2020-13985 · Other software · Contiki-os · reported by MITREHigh 7.5
An issue was discovered in Contiki through 3.0. A memory corruption vulnerability exists in the uIP TCP/IP stack component when handling RPL extension headers of IPv6 network packets in rpl_remove_header in net/rpl/rpl-ext-header.c.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in Contiki through 3.0.CVE-2020-13984 · Other software · Contiki-os · reported by MITREHigh 7.5
An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when processing IPv6 extension headers in ext_hdr_options_process in net/ipv6/uip6.c.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
May 27, 2017An issue was discovered in Contiki Operating System 3.0.CVE-2017-7296 · Other software · Contiki-os · reported by MITREMedium 6.1
An issue was discovered in Contiki Operating System 3.0. A Persistent XSS vulnerability is present in the MQTT/IBM Cloud Config page (aka mqtt.html) of cc26xx-web-demo. The cc26xx-web-demo features a webserver that runs on a constrained device. That particular page allows a user to remotely configure that device's operation by sending HTTP POST requests. The vulnerability consists of improper input sanitisation of the text fields on the MQTT/IBM Cloud config page, allowing for JavaScript code injection.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgist.github.com
May 27, 2017An issue was discovered in Contiki Operating System 3.0.CVE-2017-7295 · Other software · Contiki-os · reported by MITREHigh 7.5
An issue was discovered in Contiki Operating System 3.0. A use-after-free vulnerability exists in httpd-simple.c in cc26xx-web-demo httpd, where upon a connection close event, the http_state structure was not deallocated properly, resulting in a NULL pointer dereference in the output processing function. This resulted in a board crash, which can be used to perform denial of service.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.