PT-2024-25016 · Matter · Matter

Name of the Vulnerable Software and Affected Versions: Matter protocol versions prior to 1.1 Description: The issue is related to the Certificate Authenticated Session Establishment CASE protocol, which is used for establishing secure sessions between two devices. It allows an attacker to replay...

Matter 安全漏洞

Matter is a unified open source application layer connectivity standard open sourced by the Connectivity Standards Alliance. Designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. A security...

PT-2024-25959 · Unknown · Connectedhomeip Sdk

Name of the Vulnerable Software and Affected Versions: connectedhomeip SDK version 1.2 Description: The issue is related to an implementation problem in the Connectivity Standards Alliance Matter 1.2 protocol. This allows a third party to disclose information about devices that are part of the sa...

Matter 安全漏洞

Matter is a unified open source application layer connectivity standard open sourced by the Connectivity Standards Alliance. Designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. A security...

ZKsync Era Security Vulnerability

ZKsync Era is an open source compiler from Matter Labs. A security vulnerability exists in ZKsync Era versions prior to 1.5.0, which stems from the address used to access the stack not being properly converted to a unit, and therefore invalid stack access may exist...

ZKsync Era 安全漏洞

ZKsync Era is an open source compiler from Matter Labs. A security vulnerability exists in ZKsync Era versions prior to 1.3.10, which stems from checkifaexeculatedlast exposing a bug in the order in which Yul function arguments are evaluated...

ZKsync Era 安全漏洞

ZKsync Era is an open source compiler from Matter Labs. A security vulnerability exists in ZKsync Era versions prior to 1.4.1, which stems from a conversion error...

GHSA-R6VW-8V8R-PMP4 Server Side Template Injection (SSTI)

Summary Due to the unrestricted access to twig extension class from grav context, an attacker can redefine config variable. As a result, attacker can bypass previous patch. Details The twig context has a function declared called getFunction. php public function getFunction$name if...

PT-2024-22274 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.45 Description: The issue arises from unrestricted access to the twig extension class from the grav context, allowing an attacker to redefine the escape function and execute arbitrary commands. This can be achieved ...

PT-2024-22272 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.45 Description: Grav is an open-source, flat-file content management system. The issue arises because Grav validates accessible functions through the Utils::isDangerousFunction function but does not impose...

CVE-2023-42189

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denia...

CVE-2023-42189

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denia...

CVE-2023-42189

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denia...

CVE-2023-42189

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denia...

CVE-2023-42189

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denia...

Matter Security Breach

Matter is a unified open source application layer connectivity standard designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. Matter suffers from a security vulnerability that stems from a...

PT-2023-28290 · Nanoleaf +5 · Nanoleaf Light Strip +5

Name of the Vulnerable Software and Affected Versions: Connectivity Standards Alliance Matter Official SDK version 1.1.0.0 Nanoleaf Light strip version 3.5.10 Govee LED Strip version 3.00.42 switchBot Hub2 versions 1.0-0.8 Phillips hue hub version 1.59.1959097030 yeelight smart lamp version 1.12....

CVE-2023-42189

CVE-2023-42189 describes an Insecure Permissions vulnerability affecting multiple Matter ecosystem devices: Connectivity Standards Alliance Matter Official SDK (v1.1.0.0), Nanoleaf Light Strip (v3.5.10), Govee LED Strip (v3.00.42), switchBot Hub2 (v1.0–0.8), Philips Hue Hub (v1.59.1959097030), an...

Arbitrary Code Injection

gatsby-transformer-remark is vulnerable to Arbitrary Code Injection. The vulnerability is due to the gray-matter package which is used in parsing and is vulnerable in the default configuration, allowing an attacker to inject and execute unsanitized JavaScript codes...

CVE-2023-22491

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default...