CVE-2024-48986 | ByteOS Network

Vulnerability Details :

CVE-2024-48986

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-20 Nov, 2024 | 00:00

Updated At-26 Nov, 2024 | 15:57

An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:20 Nov, 2024 | 00:00

Updated At:26 Nov, 2024 | 15:57

▼CVE Numbering Authority (CNA)

An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018	N/A
https://github.com/mbed-ce/mbed-os/pull/385	N/A

Hyperlink: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018

Resource: N/A

Hyperlink: https://github.com/mbed-ce/mbed-os/pull/385

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Vendor

Product

CPEs

cpe:2.3:o:mbed:mbed:6.16.0:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

6.16.0

Problem Types

Type	CWE ID	Description
CWE	CWE-120	CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Type: CWE

CWE ID: CWE-120

Description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:20 Nov, 2024 | 21:15

Updated At:26 Nov, 2024 | 16:15

An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

>>mbed>>6.16.0

cpe:2.3:o:arm:mbed:6.16.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-120	Primary	nvd@nist.gov
CWE-120	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-120

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-120

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018	cve@mitre.org	Product
https://github.com/mbed-ce/mbed-os/pull/385	cve@mitre.org	Issue Tracking Patch Vendor Advisory

Hyperlink: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018

Source: cve@mitre.org

Resource:

Product

Hyperlink: https://github.com/mbed-ce/mbed-os/pull/385

Source: cve@mitre.org

Resource:

Issue Tracking

Patch

Vendor Advisory

Similar CVEs

427Records found

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.3||MEDIUM

EPSS-0.08% / 25.13%

||

7 Day CHG~0.00%

Published-19 Jan, 2024 | 20:00

Updated-09 May, 2025 | 15:07

PCMan FTP Server STOR Command denial of service

A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251555.

Vendor-pcman_ftp_server_project PCMan

Product-pcman_ftp_server FTP Server

CWE ID-CWE-404

Improper Resource Shutdown or Release

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.19% / 77.95%

||

7 Day CHG~0.00%

Published-03 Dec, 2019 | 20:00

Updated-04 Aug, 2024 | 22:10

The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted certificate in the TLS certificate handshake message, because the result of get_asn1_length() is not checked for a minimum or maximum size.

Vendor-axtls_project n/a

Product-axtls n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Juniper Networks, Inc.

Matching Score-4

Assigner-Juniper Networks, Inc.

CVSS Score-7.5||HIGH

EPSS-0.44% / 62.15%

||

7 Day CHG~0.00%

Published-17 Aug, 2021 | 22:50

Updated-16 Sep, 2024 | 21:03

Junos OS: Upon receipt of specific sequences of genuine packets destined to the device the kernel will crash and restart (vmcore)

A buffer overflow vulnerability in the TCP/IP stack of Juniper Networks Junos OS allows an attacker to send specific sequences of packets to the device thereby causing a Denial of Service (DoS). By repeatedly sending these sequences of packets to the device, an attacker can sustain the Denial of Service (DoS) condition. The device will abnormally shut down as a result of these sent packets. A potential indicator of compromise will be the following message in the log files: "eventd[13955]: SYSTEM_ABNORMAL_SHUTDOWN: System abnormally shut down" This issue is only triggered by traffic destined to the device. Transit traffic will not trigger this issue. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S19; 15.1 versions prior to 15.1R7-S10; 17.3 versions prior to 17.3R3-S12; 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R2-S7, 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R2-S2, 20.4R3; 21.1 versions prior to 21.1R2; 21.2 versions prior to 21.2R1-S1, 21.2R2.

Vendor-Juniper Networks, Inc.

Product-junos Junos OS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.5||HIGH

EPSS-0.28% / 50.77%

||

7 Day CHG-0.02%

Published-06 Apr, 2022 | 00:00

Updated-23 Apr, 2025 | 18:41

Potential heap buffer overflow when parsing DNS packets in PJSIP

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.

Vendor-pjsip pjsip Debian GNU/Linux

Product-debian_linux pjsip pjproject

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.3||MEDIUM

EPSS-0.08% / 25.13%

||

7 Day CHG~0.00%

Published-19 Jan, 2024 | 19:31

Updated-30 May, 2025 | 14:25

PCMan FTP Server PUT Command denial of service

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251554 is the identifier assigned to this vulnerability.

Vendor-pcman_ftp_server_project PCMan

Product-pcman_ftp_server FTP Server

CWE ID-CWE-404

Improper Resource Shutdown or Release

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Tenable Network Security, Inc.

Matching Score-4

Assigner-Tenable Network Security, Inc.

CVSS Score-7.5||HIGH

EPSS-13.11% / 93.85%

||

7 Day CHG~0.00%

Published-07 Apr, 2020 | 13:05

Updated-04 Aug, 2024 | 08:39

Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange.

Vendor-n/a SolarWinds Worldwide, LLC.

Product-dameware SolarWinds Dameware

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.86%

||

7 Day CHG~0.00%

Published-13 Mar, 2025 | 00:00

Updated-25 Aug, 2025 | 02:14

Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to buffer overflow via the schedStartTime and schedEndTime parameters at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

Vendor-n/a Tenda Technology Co., Ltd.

Product-rx3_firmware rx3 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.08% / 76.97%

||

7 Day CHG~0.00%

Published-25 Mar, 2022 | 17:13

Updated-03 Aug, 2024 | 05:41

engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation.

Vendor-n/a OpenBSD

Product-openbsd n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.86%

||

7 Day CHG~0.00%

Published-13 Mar, 2025 | 00:00

Updated-01 Aug, 2025 | 02:15

Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the time and timeZone parameters at /goform/SetSysTimeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

Vendor-n/a Tenda Technology Co., Ltd.

Product-rx3_firmware rx3 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.21% / 43.80%

||

7 Day CHG~0.00%

Published-12 Apr, 2022 | 19:14

Updated-03 Aug, 2024 | 05:25

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

Vendor-n/a MariaDB Foundation Debian GNU/Linux

Product-debian_linux mariadb n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.86%

||

7 Day CHG~0.00%

Published-13 Mar, 2025 | 00:00

Updated-01 Aug, 2025 | 02:15

Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the deviceId parameter at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

Vendor-n/a Tenda Technology Co., Ltd.

Product-rx3_firmware rx3 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.86%

||

7 Day CHG~0.00%

Published-13 Mar, 2025 | 00:00

Updated-25 Aug, 2025 | 02:14

Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/SetVirtualServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

Vendor-n/a Tenda Technology Co., Ltd.

Product-rx3_firmware rx3 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.86%

||

7 Day CHG~0.00%

Published-13 Mar, 2025 | 00:00

Updated-25 Aug, 2025 | 02:14

Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/setPptpUserList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

Vendor-n/a Tenda Technology Co., Ltd.

Product-rx3_firmware rx3 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.06% / 17.86%

||

7 Day CHG~0.00%

Published-13 Mar, 2025 | 00:00

Updated-01 Aug, 2025 | 02:15

Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the firewallEn parameter at /goform/SetFirewallCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

Vendor-n/a Tenda Technology Co., Ltd.

Product-rx3_firmware rx3 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.42% / 61.25%

||

7 Day CHG~0.00%

Published-14 Apr, 2021 | 13:50

Updated-04 Aug, 2024 | 17:16

Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).

Vendor-libsixel_project n/a

Product-libsixel n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-9.6||CRITICAL

EPSS-1.15% / 77.66%

||

7 Day CHG~0.00%

Published-12 Jul, 2022 | 10:06

Updated-21 Apr, 2025 | 13:51

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices.

Vendor-Siemens AG

Product-scalance_xf206-1_firmware scalance_xf201-3p_irt scalance_x208_pro_firmware scalance_x212-2ld scalance_x201-3p_irt scalance_x204-2ld scalance_xf208 scalance_x201-3p_irt_firmware scalance_x202-2p_irt_pro_firmware scalance_xf204irt scalance_xf204-2ba_irt_firmware scalance_x206-1 scalance_x204-2ld_ts_firmware scalance_x204irt scalance_x201-3p_irt_pro scalance_x204-2fm scalance_x204-2ld_ts scalance_x208 scalance_x200-4p_irt scalance_x204irt_pro_firmware scalance_x202-2irt scalance_x202-2p_irt scalance_x204-2 scalance_x224 scalance_x206-1_firmware scalance_x204-2_firmware scalance_xf204-2 scalance_xf206-1 scalance_x202-2p_irt_firmware scalance_x206-1ld_firmware scalance_x212-2ld_firmware scalance_x212-2 scalance_xf204_firmware scalance_x204-2ts_firmware scalance_xf204-2ba_irt scalance_x216_firmware scalance_x204-2ld_firmware scalance_x212-2_firmware scalance_xf208_firmware scalance_xf202-2p_irt_firmware scalance_x208_firmware scalance_x208_pro scalance_xf204-2_firmware scalance_x202-2p_irt_pro scalance_x202-2irt_firmware scalance_xf202-2p_irt scalance_x200-4p_irt_firmware scalance_x204irt_pro scalance_x216 scalance_xf201-3p_irt_firmware scalance_x204-2fm_firmware scalance_x204-2ts scalance_xf204irt_firmware scalance_x201-3p_irt_pro_firmware scalance_x204irt_firmware scalance_xf204 scalance_x206-1ld scalance_x224_firmware SCALANCE XF201-3P IRT SCALANCE XF204-2BA IRT SCALANCE X202-2P IRT SCALANCE X202-2P IRT PRO SCALANCE X204-2TS SCALANCE X206-1 SCALANCE XF204IRT SCALANCE X204IRT SCALANCE X200-4P IRT SCALANCE X224 SCALANCE XF208 SCALANCE X208 SCALANCE XF204-2 SCALANCE X204-2LD TS SCALANCE X208PRO SCALANCE X204-2LD SCALANCE X204-2 SCALANCE X216 SCALANCE X212-2LD SCALANCE X201-3P IRT PRO SCALANCE XF206-1 SCALANCE X201-3P IRT SCALANCE X206-1LD SCALANCE X212-2 SCALANCE XF202-2P IRT SCALANCE X204-2FM SCALANCE XF204 SCALANCE X202-2IRT SCALANCE X204IRT PRO

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.39% / 58.93%

||

7 Day CHG~0.00%

Published-23 Mar, 2022 | 18:57

Updated-03 Aug, 2024 | 04:56

Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ac10 ac10_firmware n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.40% / 59.76%

||

7 Day CHG~0.00%

Published-14 Apr, 2022 | 14:04

Updated-03 Aug, 2024 | 05:18

nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.

Vendor-n/a F5, Inc.

Product-njs n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-8.7||HIGH

EPSS-0.46% / 63.35%

||

7 Day CHG+0.06%

Published-21 Jun, 2025 | 01:00

Updated-09 Jul, 2025 | 18:43

TOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflow

A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Vendor-TOTOLINK

Product-a3002r_firmware a702r_firmware a3002r a3002ru a702r ex1200t_firmware ex1200t a3002ru_firmware A3002RU A702R EX1200T A3002R

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-7.5||HIGH

EPSS-2.87% / 85.74%

||

7 Day CHG~0.00%

Published-12 Apr, 2022 | 09:07

Updated-03 Aug, 2024 | 05:03

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices.

Vendor-Siemens AG

Product-scalance_x308-2m_ts_firmware scalance_x307-3_firmware scalance_xr324-12m scalance_x310fe scalance_x310fe_firmware scalance_xr324-4m_eec scalance_x308-2ld scalance_x320-1fe_firmware siplus_net_scalance_x308-2 scalance_xr324-4m_poe_firmware scalance_x308-2 scalance_x307-2eec scalance_xr324-4m_eec_firmware scalance_x308-2_firmware scalance_x304-2fe_firmware scalance_xr324-12m_ts_firmware scalance_x306-1ldfe_firmware scalance_x307-2eec_firmware scalance_x320-1-2ldfe siplus_net_scalance_x308-2_firmware scalance_x308-2lh_firmware scalance_x302-7eec_firmware scalance_x308-2lh scalance_x307-3ld_firmware scalance_x310 scalance_x320-1-2ldfe_firmware scalance_xr324-12m_firmware scalance_x308-2m_poe_firmware scalance_x308-2lh\+scalance_x310_firmware scalance_x308-2m_poe scalance_x308-2lh\+_firmware scalance_x308-2ld_firmware scalance_xr324-12m_ts scalance_x308-2m_ts scalance_x308-2m_firmware scalance_x320-1fe scalance_x408-2 scalance_xr324-4m_poe scalance_x306-1ldfe scalance_x307-3ld scalance_x308-2m scalance_x408-2_firmware scalance_x307-3 scalance_x304-2fe scalance_xr324-4m_poe_ts scalance_xr324-4m_poe_ts_firmware scalance_x302-7eec SCALANCE XR324-12M TS (24V)SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)SCALANCE XR324-4M PoE (24V, ports on rear)SCALANCE XR324-4M EEC (24V, ports on front)SCALANCE XR324-12M (230V, ports on rear)SCALANCE X307-2 EEC (2x 24V, coated)SCALANCE XR324-4M PoE TS (24V, ports on front)SCALANCE X307-3 SCALANCE X308-2M SCALANCE XR324-12M (24V, ports on rear)SCALANCE X308-2 SCALANCE X308-2M PoE SCALANCE X310FE SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)SCALANCE X308-2LH+SCALANCE X302-7 EEC (24V, coated)SCALANCE X307-2 EEC (230V, coated)SCALANCE X307-3LD SCALANCE X308-2LH SCALANCE XR324-4M EEC (24V, ports on rear)SCALANCE XR324-4M PoE (24V, ports on front)SCALANCE X302-7 EEC (2x 230V)SCALANCE X408-2 SIPLUS NET SCALANCE X308-2 SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)SCALANCE XR324-4M PoE (230V, ports on rear)SCALANCE X302-7 EEC (230V)SCALANCE X307-2 EEC (24V, coated)SCALANCE X307-2 EEC (2x 230V, coated)SCALANCE X302-7 EEC (2x 24V, coated)SCALANCE X308-2LD SCALANCE X307-2 EEC (24V)SCALANCE X304-2FE SCALANCE X310 SCALANCE X307-2 EEC (2x 24V)SCALANCE X307-2 EEC (230V)SCALANCE XR324-12M (24V, ports on front)SCALANCE X320-1 FE SCALANCE X302-7 EEC (2x 24V)SCALANCE X306-1LD FE SCALANCE X308-2M TS SCALANCE XR324-4M PoE (230V, ports on front)SCALANCE X307-2 EEC (2x 230V)SCALANCE X302-7 EEC (24V)SCALANCE X302-7 EEC (230V, coated)SCALANCE X302-7 EEC (2x 230V, coated)SCALANCE X320-1-2LD FE SCALANCE XR324-4M EEC (2x 24V, ports on rear)SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)SCALANCE XR324-12M (230V, ports on front)SCALANCE XR324-4M EEC (2x 24V, ports on front)

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.11% / 29.59%

||

7 Day CHG-0.06%

Published-28 Mar, 2025 | 00:00

Updated-08 May, 2025 | 17:38

Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request.

Vendor-n/a Tenda Technology Co., Ltd.

Product-w6-s w6-s_firmware n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-8.2||HIGH

EPSS-0.87% / 74.31%

||

7 Day CHG~0.00%

Published-12 Jul, 2022 | 10:06

Updated-21 Apr, 2025 | 13:52

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the GET parameter XNo of incoming HTTP requests. This could allow an unauthenticated remote attacker to crash affected devices.

Vendor-Siemens AG

Product-scalance_xf206-1_firmware scalance_xf201-3p_irt scalance_x208_pro_firmware scalance_x212-2ld scalance_x201-3p_irt scalance_x204-2ld scalance_xf208 scalance_x201-3p_irt_firmware scalance_x202-2p_irt_pro_firmware scalance_xf204irt scalance_xf204-2ba_irt_firmware scalance_x206-1 scalance_x204-2ld_ts_firmware scalance_x204irt scalance_x201-3p_irt_pro scalance_x204-2fm scalance_x204-2ld_ts scalance_x208 scalance_x200-4p_irt scalance_x204irt_pro_firmware scalance_x202-2irt scalance_x202-2p_irt scalance_x204-2 scalance_x224 scalance_x206-1_firmware scalance_x204-2_firmware scalance_xf204-2 scalance_xf206-1 scalance_x202-2p_irt_firmware scalance_x206-1ld_firmware scalance_x212-2ld_firmware scalance_x212-2 scalance_xf204_firmware scalance_x204-2ts_firmware scalance_xf204-2ba_irt scalance_x216_firmware scalance_x204-2ld_firmware scalance_x212-2_firmware scalance_xf208_firmware scalance_xf202-2p_irt_firmware scalance_x208_firmware scalance_x208_pro scalance_xf204-2_firmware scalance_x202-2p_irt_pro scalance_x202-2irt_firmware scalance_xf202-2p_irt scalance_x200-4p_irt_firmware scalance_x204irt_pro scalance_x216 scalance_xf201-3p_irt_firmware scalance_x204-2fm_firmware scalance_x204-2ts scalance_xf204irt_firmware scalance_x201-3p_irt_pro_firmware scalance_x204irt_firmware scalance_xf204 scalance_x206-1ld scalance_x224_firmware SCALANCE XF201-3P IRT SCALANCE XF204-2BA IRT SCALANCE X202-2P IRT SCALANCE X202-2P IRT PRO SCALANCE X204-2TS SCALANCE X206-1 SCALANCE XF204IRT SCALANCE X204IRT SCALANCE X200-4P IRT SCALANCE X224 SCALANCE XF208 SCALANCE X208 SCALANCE XF204-2 SCALANCE X204-2LD TS SCALANCE X208PRO SCALANCE X204-2LD SCALANCE X204-2 SCALANCE X216 SCALANCE X212-2LD SCALANCE X201-3P IRT PRO SCALANCE XF206-1 SCALANCE X201-3P IRT SCALANCE X206-1LD SCALANCE X212-2 SCALANCE XF202-2P IRT SCALANCE X204-2FM SCALANCE XF204 SCALANCE X202-2IRT SCALANCE X204IRT PRO

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-7.5||HIGH

EPSS-2.87% / 85.74%

||

7 Day CHG~0.00%

Published-12 Apr, 2022 | 09:07

Updated-03 Aug, 2024 | 05:03

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. Affected devices do not properly validate the GET parameter XNo of incoming HTTP requests. This could allow an unauthenticated remote attacker to crash affected devices.

Vendor-Siemens AG

Product-scalance_x308-2m_ts_firmware scalance_x307-3_firmware scalance_xr324-12m scalance_x310fe scalance_x310fe_firmware scalance_xr324-4m_eec scalance_x308-2ld scalance_x320-1fe_firmware siplus_net_scalance_x308-2 scalance_xr324-4m_poe_firmware scalance_x308-2 scalance_x307-2eec scalance_xr324-4m_eec_firmware scalance_x308-2_firmware scalance_x304-2fe_firmware scalance_xr324-12m_ts_firmware scalance_x306-1ldfe_firmware scalance_x307-2eec_firmware scalance_x320-1-2ldfe siplus_net_scalance_x308-2_firmware scalance_x308-2lh_firmware scalance_x302-7eec_firmware scalance_x308-2lh scalance_x307-3ld_firmware scalance_x310 scalance_x320-1-2ldfe_firmware scalance_xr324-12m_firmware scalance_x308-2m_poe_firmware scalance_x308-2lh\+scalance_x310_firmware scalance_x308-2m_poe scalance_x308-2lh\+_firmware scalance_x308-2ld_firmware scalance_xr324-12m_ts scalance_x308-2m_ts scalance_x308-2m_firmware scalance_x320-1fe scalance_x408-2 scalance_xr324-4m_poe scalance_x306-1ldfe scalance_x307-3ld scalance_x308-2m scalance_x408-2_firmware scalance_x307-3 scalance_x304-2fe scalance_xr324-4m_poe_ts scalance_xr324-4m_poe_ts_firmware scalance_x302-7eec SCALANCE XR324-12M TS (24V)SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)SCALANCE XR324-4M PoE (24V, ports on rear)SCALANCE XR324-4M EEC (24V, ports on front)SCALANCE XR324-12M (230V, ports on rear)SCALANCE X307-2 EEC (2x 24V, coated)SCALANCE XR324-4M PoE TS (24V, ports on front)SCALANCE X307-3 SCALANCE X308-2M SCALANCE XR324-12M (24V, ports on rear)SCALANCE X308-2 SCALANCE X308-2M PoE SCALANCE X310FE SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)SCALANCE X308-2LH+SCALANCE X302-7 EEC (24V, coated)SCALANCE X307-2 EEC (230V, coated)SCALANCE X307-3LD SCALANCE X308-2LH SCALANCE XR324-4M EEC (24V, ports on rear)SCALANCE XR324-4M PoE (24V, ports on front)SCALANCE X302-7 EEC (2x 230V)SCALANCE X408-2 SIPLUS NET SCALANCE X308-2 SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)SCALANCE XR324-4M PoE (230V, ports on rear)SCALANCE X302-7 EEC (230V)SCALANCE X307-2 EEC (24V, coated)SCALANCE X307-2 EEC (2x 230V, coated)SCALANCE X302-7 EEC (2x 24V, coated)SCALANCE X308-2LD SCALANCE X307-2 EEC (24V)SCALANCE X304-2FE SCALANCE X310 SCALANCE X307-2 EEC (2x 24V)SCALANCE X307-2 EEC (230V)SCALANCE XR324-12M (24V, ports on front)SCALANCE X320-1 FE SCALANCE X302-7 EEC (2x 24V)SCALANCE X306-1LD FE SCALANCE X308-2M TS SCALANCE XR324-4M PoE (230V, ports on front)SCALANCE X307-2 EEC (2x 230V)SCALANCE X302-7 EEC (24V)SCALANCE X302-7 EEC (230V, coated)SCALANCE X302-7 EEC (2x 230V, coated)SCALANCE X320-1-2LD FE SCALANCE XR324-4M EEC (2x 24V, ports on rear)SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)SCALANCE XR324-12M (230V, ports on front)SCALANCE XR324-4M EEC (2x 24V, ports on front)

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-7.00% / 91.08%

||

7 Day CHG~0.00%

Published-21 Dec, 2020 | 21:36

Updated-04 Aug, 2024 | 16:55

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request.

Vendor-miniweb_http_server_project n/a

Product-miniweb_http_server n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.41% / 60.71%

||

7 Day CHG~0.00%

Published-17 Mar, 2022 | 00:00

Updated-30 Oct, 2024 | 14:35

stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.

Vendor-nothings n/a

Product-stb_truetype.h n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-4

Assigner-Hitachi Energy

Matching Score-4

Assigner-Hitachi Energy

CVSS Score-5.9||MEDIUM

EPSS-0.16% / 37.12%

||

7 Day CHG~0.00%

Published-19 Dec, 2023 | 14:53

Updated-25 Sep, 2024 | 09:15

Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.

Vendor-Hitachi Energy Ltd.

Product-rtu500_firmware rtu500 RTU500 series CMU Firmware

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.89% / 74.58%

||

7 Day CHG~0.00%

Published-31 May, 2022 | 19:51

Updated-03 Aug, 2024 | 04:20

An issue was discovered in WinAPRS 2.9.0. A buffer overflow in DIGI address processing for VHF KISS packets allows a remote attacker to cause a denial of service (daemon crash) via a malicious AX.25 packet over the air. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Vendor-winaprs n/a

Product-winaprs n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.5||HIGH

EPSS-0.33% / 55.48%

||

7 Day CHG+0.04%

Published-22 Mar, 2022 | 00:00

Updated-23 Apr, 2025 | 18:45

Stack buffer overflow in pjproject

PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

Vendor-teluu pjsip Debian GNU/Linux

Product-debian_linux pjsip pjproject

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-4

Assigner-Apache Software Foundation

Matching Score-4

Assigner-Apache Software Foundation

CVSS Score-7.5||HIGH

EPSS-1.46% / 80.05%

||

7 Day CHG~0.00%

Published-25 Aug, 2022 | 00:00

Updated-03 Aug, 2024 | 03:21

libapreq2 multipart form parse memory corruption

A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.

Vendor-The Apache Software Foundation Fedora Project Debian GNU/Linux

Product-debian_linux fedora libapreq2 libapreq2

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-6.2||MEDIUM

EPSS-0.10% / 28.13%

||

7 Day CHG~0.00%

Published-21 Oct, 2022 | 00:00

Updated-22 Apr, 2025 | 17:18

Stack Buffer Overflow in iowow

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.

Vendor-softmotions Softmotions

Product-iowow iowow

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.02% / 3.06%

||

7 Day CHG~0.00%

Published-04 May, 2024 | 00:00

Updated-05 Aug, 2024 | 19:08

TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add '\0' to the end of long msg data. It can be exploited via crafted TCP packets.

Vendor-n/a simplenetwork_project

Product-n/a simplenetwork

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Huawei Technologies

Matching Score-4

Assigner-Huawei Technologies

CVSS Score-7.5||HIGH

EPSS-0.08% / 25.22%

||

7 Day CHG~0.00%

Published-18 Feb, 2024 | 03:27

Updated-13 Mar, 2025 | 14:48

Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.

Vendor-Huawei Technologies Co., Ltd.

Product-emui harmonyos HarmonyOS EMUI harmonyos emui

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.5||HIGH

EPSS-0.97% / 75.64%

||

7 Day CHG~0.00%

Published-03 Mar, 2022 | 00:00

Updated-22 Apr, 2025 | 18:21

Buffer Overflow in Twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

Vendor-twisted twisted Fedora Project Debian GNU/Linux Oracle Corporation

Product-http_server debian_linux fedora zfs_storage_appliance_kit twisted twisted

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-770

Allocation of Resources Without Limits or Throttling

Matching Score-4

Assigner-Juniper Networks, Inc.

Matching Score-4

Assigner-Juniper Networks, Inc.

CVSS Score-7.5||HIGH

EPSS-0.61% / 68.81%

||

7 Day CHG~0.00%

Published-20 Jul, 2022 | 14:13

Updated-16 Sep, 2024 | 18:08

Junos OS: SRX series: The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search

A Buffer Overflow vulnerability in the PFE of Juniper Networks Junos OS on SRX series allows an unauthenticated network based attacker to cause a Denial of Service (DoS). The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search feature of UTM (Unified Threat management). Continued receipt of this specific traffic will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS: 20.2 versions prior to 20.2R3-S4 on SRX Series; 20.3 versions prior to 20.3R3-S3 on SRX Series; 20.4 versions prior to 20.4R3-S3 on SRX Series; 21.1 versions prior to 21.1R3-S1 on SRX Series; 21.2 versions prior to 21.2R2-S2, 21.2R3 on SRX Series; 21.3 versions prior to 21.3R2 on SRX Series; 21.4 versions prior to 21.4R2 on SRX Series. This issue does not affect Juniper Networks Junos OS versions prior to 20.2R1.

Vendor-Juniper Networks, Inc.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.67% / 70.45%

||

7 Day CHG~0.00%

Published-24 Jan, 2024 | 00:00

Updated-05 Sep, 2024 | 18:35

Buffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service via a crafted string in the application URL.

Vendor-ctan n/a

Product-mathtex n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-CERT@VDE

Matching Score-4

Assigner-CERT@VDE

CVSS Score-7.5||HIGH

EPSS-0.11% / 30.24%

||

7 Day CHG~0.00%

Published-12 May, 2025 | 08:01

Updated-16 May, 2025 | 09:00

AUMA Riester: Buffer overflow in service telegram

An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface.

Vendor-Auma Riester

Product-TIGRON MEC 03.01 PROFOX TIGRON SIL AC1.2 SGx/SVx

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.67% / 70.45%

||

7 Day CHG~0.00%

Published-24 Jan, 2024 | 00:00

Updated-30 May, 2025 | 15:15

Buffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when using \convertpath.

Vendor-ctan n/a

Product-mathtex n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-16.26% / 94.57%

||

7 Day CHG~0.00%

Published-05 Jan, 2024 | 00:00

Updated-13 Jun, 2025 | 19:15

Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp parameter in the pingSet function.

Vendor-n/a Tenda Technology Co., Ltd.

Product-i29_firmware i29 n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.16% / 77.77%

||

7 Day CHG~0.00%

Published-16 Dec, 2023 | 00:00

Updated-02 Aug, 2024 | 22:23

A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet (if a websocket port is open). Remote code execution might be possible on some uncommon, older platforms.

Vendor-unrealircd n/a

Product-unrealircd n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7||HIGH

EPSS-0.36% / 57.55%

||

7 Day CHG~0.00%

Published-22 Dec, 2023 | 15:18

Updated-02 Aug, 2024 | 21:37

Unauthenticated heap buffer overflow in Gorrila codec decompression

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

Vendor-clickhouse ClickHouse

Product-clickhouse_cloud clickhouse ClickHouse

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.25% / 47.78%

||

7 Day CHG~0.00%

Published-15 Nov, 2023 | 00:00

Updated-29 Aug, 2024 | 17:06

Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message whose Recovery Time Stamp IE length is mutated to zero.

Vendor-free5gc n/a

Product-free5gc n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.18% / 39.81%

||

7 Day CHG~0.00%

Published-25 Dec, 2023 | 00:00

Updated-23 Apr, 2025 | 16:12

An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible.

Vendor-stormshield n/a

Product-stormshield_network_security n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-Hitachi Energy

Matching Score-4

Assigner-Hitachi Energy

CVSS Score-7.5||HIGH

EPSS-0.15% / 36.81%

||

7 Day CHG+0.01%

Published-04 Jan, 2024 | 09:15

Updated-22 May, 2025 | 18:20

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.

Vendor-Hitachi Energy Ltd.

Product-rtu560 rtu520_firmware rtu540_firmware rtu560_firmware rtu520 rtu530_firmware rtu530 rtu540 RTU500 series CMU firmware

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.13% / 33.21%

||

7 Day CHG~0.00%

Published-27 Oct, 2023 | 00:00

Updated-09 Sep, 2024 | 15:36

In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.

Vendor-memcached n/a memcached

Product-memcached n/a memcached

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.15% / 36.14%

||

7 Day CHG~0.00%

Published-13 Nov, 2023 | 00:00

Updated-03 Sep, 2024 | 16:12

Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages.

Vendor-free5gc n/a

Product-upf free5gc smf n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.86% / 74.08%

||

7 Day CHG~0.00%

Published-28 Aug, 2023 | 00:00

Updated-02 Aug, 2024 | 18:46

Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component.

Vendor-o-ran-sc n/a

Product-ric_message_router n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.08% / 23.85%

||

7 Day CHG~0.00%

Published-15 Nov, 2023 | 00:00

Updated-29 Aug, 2024 | 15:29

Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number is mutated to overflow bytes.

Vendor-free5gc n/a

Product-free5gc n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.08% / 25.16%

||

7 Day CHG~0.00%

Published-13 Oct, 2023 | 00:00

Updated-17 Sep, 2024 | 20:37

Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Vendor-n/a Netis Systems Co., Ltd.

Product-n3m n3m_firmware n/a n3m

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.19% / 77.96%

||

7 Day CHG~0.00%

Published-29 Apr, 2024 | 00:00

Updated-02 Aug, 2024 | 20:45

Buffer Overflow vulnerability in msoulier tftpy commit 467017b844bf6e31745138a30e2509145b0c529c allows a remote attacker to cause a denial of service via the parse function in the TftpPacketFactory class.

Vendor-n/a msoulier

Product-n/a tftpy

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.48% / 64.01%

||

7 Day CHG~0.00%

Published-29 Apr, 2024 | 00:00

Updated-06 Sep, 2024 | 19:35

Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.

Vendor-n/a osrg

Product-n/a gobgp

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')