CVE-2024-23973

CVE-2024-23973 affects Silicon Labs Gecko OS. The vulnerability stems from improper validation of the length of user-supplied data during HTTP GET handling, leading to a stack-based buffer overflow. This flaw enables network-adjacent attackers to execute arbitrary code in the device’s context wit...

CVE-2024-24731

CVE-2024-24731 affects Silicon Labs Gecko OS. The vulnerability is a stack-based buffer overflow in the http_download command caused by insufficient validation of user-supplied data length, enabling network-adjacent attackers to execute arbitrary code with device context and no authentication. Do...

CVE-2024-24731 Silicon Labs Gecko OS http_download Stack-based Buffer Overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the httpdownload command. The issue results from t...

CVE-2024-24731 Silicon Labs Gecko OS http_download Stack-based Buffer Overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the httpdownload command. The issue results from t...

Anatomy of Celestial Stealer: Malware-as-a-Service Revealed

Anatomy of Celestial Stealer: Malware-as-a-Service Revealed By Niranjan Hegde, Adarsh S and Shashikala Piddannavar · December 3, 2024 Introduction During proactive hunting, Trellix Advanced Research Center found samples belonging to Celestial Stealer, a JavaScript-based infostealer which is...

Advanced Browser Data Extraction for Chromium and Gecko Browsers

This post-exploitation module extracts sensitive browser data from both Chromium-based and Gecko-based browsers on the target system. It supports the decryption of passwords and cookies using Windows Data Protection API DPAPI and can extract additional data such as browsing history, keyword searc...

MAL-2024-9683 Malicious code in late-amethyst-gecko (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in late-amethyst-gecko (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-23938

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938 Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938 Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938

The CVE-2024-23938 entry describes a stack-based buffer overflow in the Silicon Labs Gecko OS Debug Interface that allows remote code execution by network-adjacent attackers without authentication. The root cause is improper validation of the length of user-supplied data prior to copying it into ...

Silicon Labs Gecko OS 安全漏洞

Silicon Labs Gecko OS is an operating system designed for Internet of Things IoT devices from Silicon Labs, Inc. It provides secure wired and wireless network connectivity for Silicon Labs' hardware platforms with integrated firmware updates and cloud connectivity support. A security vulnerabilit...

Khoj Open Redirect Vulnerability in Login Page

Summary An attacker can use the next parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking app.khoj.dev url. For example, https://app.khoj.dev/login?next=//example.com will redirect to the https://example.com page. Details The problem seems...

Exploit for Out-of-bounds Write in Mozilla Firefox

CVE-2024-29943 A Pwn2Own SpiderMonkey JIT Bug: From Integer R...

PT-2024-20189 · Silicon · Gecko Os

Name of the Vulnerable Software and Affected Versions: Silicon Labs Gecko OS affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific fl...

(Pwn2Own) Silicon Labs Gecko OS http_download Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the httpdownload command. The issue results from t...

(Pwn2Own) Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper...

(Pwn2Own) Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a...