Moddable SDK Stack Buffer Overflow Vulnerability

Moddable SDK is a set of software development kits SDKs for IoT embedded software development from the US company Moddable. The Moddable SDK has a stack buffer overflow vulnerability in v11.5.0 that stems from a boundary error in the component interceptorstrcat when handling untrusted input. A...

Moddable SDK Heap Buffer Overflow Vulnerability (CNVD-2022-08216)

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable, U.S. Moddable SDK in v11.5.0 is vulnerable to a heap buffer overflow vulnerability stemming from a boundary error in component libcstartmain when handling untrusted input. A remote attacker could...

Moddable SDK Denial of Service Vulnerability

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable, Inc. A denial of service vulnerability exists in Moddable SDK v11.5.0, which stems from the presence of a NULL pointer dereference. An attacker could exploit this vulnerability to cause a denial of...

Moddable SDK Heap Buffer Overflow Vulnerability (CNVD-2022-08375)

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable USA. Moddable SDK in version 11.5.0 has a heap buffer overflow vulnerability, which stems from xs/sources/xsDataView.c in fxUint8Getter in the memory buffer vulnerability has an incorrect restrictio...

RUSTSEC-2022-0005 crate has been renamed to `ftdi-embedded-hal`

This crate has been renamed from ftd2xx-embedded-hal to ftdi-embedded-hal. The new repository location is:...

CVE-2021-44734

Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device...

CVE-2021-44735

Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07...

CVE-2021-44735

Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07...

Command injection

Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07...

CVE-2021-44735

CVE-2021-44735 is an embedded web server command injection vulnerability in Lexmark devices (through 2021-12-07). The linked advisories/coverage confirm a Lexmark embedded web service issue enabling command execution via the device’s web interface. Multiple vendor/security sources reference this ...

in mastodon/mastodon

Description The message event listener in embed.js does not check the origin of postMessage before changing the height of the embedded toots. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input id and height to code and now attacker is able to...

PT-2022-12212 · Lexmark · Lexmark Devices

Name of the Vulnerable Software and Affected Versions: Lexmark devices affected versions not specified Description: The issue is related to an embedded web server input sanitization vulnerability in Lexmark devices, which can lead to remote code execution on the device. Recommendations: At the...

Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2021-46225

A buffer overflow in the GmfOpenMesh function of libMeshb v7.61 allows attackers to cause a Denial of Service DoS via a crafted MESH file...

moonlight-embedded -- multiple vulnerabilities

The moonlight-embedded project reports: Moonlight Embedded v2.6.1 fixed CVE-2023-42799, CVE-2023-42800, and CVE-2023-42801...

A Log4j Retrospective Part 2: Data Exfiltration and Remote Code Execution Exploits

Akamai CTO Charlie Gero shows how the Log4j threat surface could extend to unpatchable embedded and IoT devices...

OESA-2022-1482 python-lxml security update

XML processing library combining libxml2/libxslt with the ElementTree API. Security Fixes: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG...