CVE-2024-21639: Out-of-bounds Read

CEF Chromium Embedded Framework is a simple framework for embedding Chromium-based browsers in other applications. CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patche...

Chromium Embedded Framework (CEF) Buffer Error Vulnerability

Chromium Embedded Framework CEF is a simple framework for Chromium Embedded Framework open source. It is used to embed Chromium-based browsers in other applications. Chromium Embedded Framework CEF suffers from a buffer error vulnerability that stems from CefLayeredWindowUpdaterOSR...

2024-01 Security and Quality Rollup for .NET Framework 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Embedded Standard 7 for x64 (KB5034277)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

2024-01 Security and Quality Rollup for .NET Framework 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Embedded Standard 7 (KB5034277)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

January 9, 2024—KB5034169 (Monthly Rollup)

January 9, 2024—KB5034169 Monthly Rollup Applies To Windows Server 2008 R2 Enterprise ESU Windows Server 2008 R2 Standard ESU Windows Server 2008 R2 Datacenter ESU Windows Embedded POSReady 7 ESU Note REMINDER As of January 10, 2023, Microsoft no longer provides security updates or technical...

January 9, 2024—KB5034167 (Security-only update)

January 9, 2024—KB5034167 Security-only update Applies To Windows Server 2008 R2 Enterprise ESU Windows Server 2008 R2 Standard ESU Windows Server 2008 R2 Datacenter ESU Windows Embedded POSReady 7 ESU Note REMINDER As of January 10, 2023, Microsoft no longer provides security updates or technica...

Cesanta MJS Denial of Service Vulnerability (CNVD-2024-34384)

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. Designed for microcontrollers with limited resources. The main design goals were a small footprint and simple C/C++ interoperability. Cesanta MJS has a denial of service vulnerability that can be exploited by an attacker...

PT-2024-2148

Name of the Vulnerable Software and Affected Versions X-Rite MAT 6 Kohinoor affected versions not specified Description The issue is related to insufficient input validation in the software of embedded spectrophotometers. This could allow a remote attacker to impact the confidentiality, integrity...

Cesanta MJS Denial of Service Vulnerability (CNVD-2024-27558)

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. A denial of service vulnerability exists in Cesanta MJS version 2.20.0, which is caused by a flaw in the mjs+0x4ec508 component. An attacker could exploit this vulnerability to cause a denial of service...

Apache OpenOffice < 4.1.15 Multiple Vulnerabilities

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.15. It is, therefore, affected by multiple vulnerabilities as stated in the vendor advisories and release notes. - Apache OpenOffice documents can contain links that call internal macros with arbitrary...

Apache OpenOffice < 4.1.15 Multiple Vulnerabilities (macOS)

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.15. It is, therefore, affected by multiple vulnerabilities as stated in the vendor advisories and release notes. - Apache OpenOffice documents can contain links that call internal macros with arbitrary...

SugarCRM Template Code Execution

The vulnerability of the template mechanism in the SugarCRM system is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted PNG file, which contains embedded PHP code...

PT-2024-5261 · Qualcomm · Qualcomm Embedded Platform

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to a memory corruption problem that occurs when an invoke call and a TEE call are bound for the same trusted application. It is also...

PT-2024-5348 · Qualcomm · Qualcomm Microprogram +1

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to memory corruption that occurs while processing a key blob passed by the user. This can potentially allow an attacker to execute arbitrary...

PT-2024-5263 · Qualcomm · Qualcomm Embedded Platform

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to information disclosure when Address Space Layout Randomization ASLR relocates certain portions in virtual address space as one chunk...

org.infinispan:infinispan-distribution (9.3.4.final), org.infinispan:infinispan-feature-pack-server (9.3.4.final) +4 more potentially affected by CVE-2023-3629 via org.infinispan:infinispan-server-rest (9.3.4.final)

org.infinispan:infinispan-server-rest MAVEN version 9.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-server-rest and may be impacted: - org.infinispan:infinispan-distribution 9.3.4.final -...

org.infinispan:infinispan-distribution (9.4.9.final), org.infinispan:infinispan-feature-pack-server (9.4.9.final) +4 more potentially affected by CVE-2023-3628 via org.infinispan:infinispan-server-rest (9.4.9.final)

org.infinispan:infinispan-server-rest MAVEN version 9.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-server-rest and may be impacted: - org.infinispan:infinispan-distribution 9.4.9.final -...

org.infinispan:infinispan-distribution (9.4.5.final), org.infinispan:infinispan-feature-pack-server (9.4.5.final) +4 more potentially affected by CVE-2023-3629 via org.infinispan:infinispan-server-rest (9.4.5.final)

org.infinispan:infinispan-server-rest MAVEN version 9.4.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-server-rest and may be impacted: - org.infinispan:infinispan-distribution 9.4.5.final -...

org.infinispan:infinispan-distribution (9.4.0.cr3), org.infinispan:infinispan-feature-pack-server (9.4.0.cr3) +4 more potentially affected by CVE-2023-3629 via org.infinispan:infinispan-server-rest (9.4.0.cr3)

org.infinispan:infinispan-server-rest MAVEN version 9.4.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-server-rest and may be impacted: - org.infinispan:infinispan-distribution 9.4.0.cr3 -...

org.infinispan:infinispan-distribution (>=9.0.0.beta2, <=10.0.0.beta3), org.infinispan:infinispan-feature-pack-server (10.0.0.beta3) +6 more potentially affected by CVE-2023-3628 via org.infinispan:infinispan-server-rest (10.0.0.beta3)

org.infinispan:infinispan-server-rest MAVEN version 10.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-server-rest and may be impacted: - org.infinispan:infinispan-distribution =9.0.0.beta2, =10.0.0.beta3 -...