Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ZephyrprojectZephyr2.2.0

13 matches found

CVE
CVE•added 2020/06/05 6:15 p.m.•106 views

CVE-2020-10071

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

9.8CVSS10AI score0.13899EPSS
CVE
CVE•added 2020/06/05 6:15 p.m.•105 views

CVE-2020-10062

An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

9.8CVSS9.8AI score0.05817EPSS
CVE
CVE•added 2020/06/05 6:15 p.m.•105 views

CVE-2020-10070

In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

9.8CVSS9.9AI score0.06474EPSS
CVE
CVE•added 2020/06/05 6:15 p.m.•104 views

CVE-2020-10063

A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

7.5CVSS7AI score0.0187EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•71 views

CVE-2020-13603

Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94vp-8gc2-rm45

7.8CVSS7.3AI score0.00057EPSS
CVE
CVE•added 2020/05/11 11:15 p.m.•66 views

CVE-2020-10059

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr version...

5.8CVSS5.8AI score0.00373EPSS
CVE
CVE•added 2020/05/11 11:15 p.m.•54 views

CVE-2020-10022

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later ve...

9.8CVSS9.6AI score0.01697EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•35 views

CVE-2020-10065

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c

8.8CVSS6.4AI score0.00205EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•34 views

CVE-2020-10069

Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-f6vh-7v4x-8fjp

6.5CVSS5.4AI score0.00095EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•33 views

CVE-2020-10072

Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges (CWE-280). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm...

5.9CVSS5.4AI score0.00036EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•32 views

CVE-2020-10064

Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gvq-h42f-v3c7

9.8CVSS9.3AI score0.00438EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•32 views

CVE-2020-10066

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr

5.7CVSS4.7AI score0.00054EPSS
CVE
CVE•added 2021/05/25 5:15 p.m.•32 views

CVE-2020-13602

Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-...

5.5CVSS5AI score0.00112EPSS