Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
363 results · page 6 of 8
Jul 9, 2024Zephyr Project Manager: Improper Privilege ManagementCVE-2024-37484 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.97
- What to do
- Affects up to 3.3.97. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 3, 2024A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE deviceCVE-2024-3332 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.5
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024An malicious BLE device can crash BLE victim device by sending malformed gatt packetCVE-2024-3077 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination addrCVE-2023-7060 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Possible buffer overflow in is_mount_pointCVE-2023-6881 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.3
Possible buffer overflow in is_mount_point
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission CVE-2024-1638 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Signed to unsigned conversion esp32_ipm_sendCVE-2023-6249 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8
Signed to unsigned conversion esp32_ipm_send
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024can: out of bounds in remove_rx_filter functionCVE-2023-5779 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.4
can: out of bounds in remove_rx_filter function
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Unchecked length coming from user input in settings shellCVE-2023-6749 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8
Unchecked length coming from user input in settings shell
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Zephyr Project Manager: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31237 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 21, 2023Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.CVE-2023-5055 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.3
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the vicCVE-2023-4424 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.3
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driverCVE-2023-5139 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.4
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 25, 2023Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.cCVE-2023-5753 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 13, 2023Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.CVE-2023-4257 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 13, 2023Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverCVE-2023-4263 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 12, 2023The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y.CVE-2023-5563 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.1
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Potential buffer overflow vulnerability in the Zephyr CAN bus subsystemCVE-2023-3725 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 27, 2023Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.CVE-2023-5184 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7
Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 27, 2023Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.CVE-2023-4264 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.1
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 27, 2023Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.CVE-2023-4260 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 25, 2023Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.CVE-2023-4259 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.1
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 25, 2023In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionCVE-2023-4258 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2023Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_pCVE-2023-4265 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.4
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 10, 2023Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.CVE-2023-2234 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cCVE-2023-1902 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 5.9
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller CVE-2023-1901 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 5.9
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A missing nullptr-check in handle_ra_input can cause a nullptr-deref.CVE-2023-0359 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 5.9
A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.CVE-2023-34373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.
- Affected
- up to 3.3.93
- What to do
- Affects up to 3.3.93. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 30, 2023At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation isCVE-2023-0779 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.7
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbiCVE-2023-22892 · Other software · Smartbear · reported by MITREHigh 7.5
There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances.
- Product
- Zephyr Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartbear.comsmartbear.com
Mar 8, 2023There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords fCVE-2023-22891 · Other software · Smartbear · reported by MITREHigh 8.1
There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords for other accounts.
- Product
- Zephyr Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartbear.comsmartbear.com
Mar 8, 2023SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of seCVE-2023-22890 · Other software · Smartbear · reported by MITREHigh 7.5
SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition.
- Product
- Zephyr Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartbear.comsmartbear.com
Mar 8, 2023SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation.CVE-2023-22889 · Other software · Smartbear · reported by MITRECritical 9.8
SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution by unauthenticated users.
- Product
- Zephyr Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartbear.comsmartbear.com
Feb 26, 2023Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stackCVE-2021-3329 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.6
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzephyrprojectsec.atlassian.netzephyrprojectsec.atlassian.net
Jan 24, 2023A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.CVE-2023-0396 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2023Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.CVE-2022-3806 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.8
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.CVE-2023-0397 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.6
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.CVE-2021-3966 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.6
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023There is no check to see if slot 0 is being uploaded from the device to the host.CVE-2022-0553 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.5
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022There is an error in the condition of the last if-statement in the function smp_check_keys.CVE-2022-2993 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node.CVE-2022-2741 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Zephyr Project Manager: Does not have any authorisationCVE-2022-2839 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.55
- What to do
- Update Zephyr Project Manager to 3.2.55 or newer.
Sep 28, 2022A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4.CVE-2022-3333 · Other software · Zephyr · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
- Product
- Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Aug 31, 2022In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.CVE-2022-1841 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.2
In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.CVE-2022-1042 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.CVE-2022-1041 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Information leakage in le_ecred_conn_req().CVE-2021-3435 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4
Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Stack based buffer overflow in le_ecred_conn_req().CVE-2021-3434 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.9
Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrm
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.