Overview 895 matches · 10 in Waratek scope · 3 protected · 25 exploited · 14 CISA KEV · 58 public PoC · 36 EPSS ≥ 0.5
895matches
10in Waratek scope1.1%
3protected0.3%
25exploited2.8%
14CISA KEV1.6%
58public PoC6.5%
36EPSS ≥ 0.54.0%
Protected by Waratek
3
0.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
7
0.8%
Outside Waratek scope
47
5.3%
Not applicable
838
93.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.3%
partly blocked
0
0.0%
not blocked
892
99.7%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 122 / year
20071
Not applicable1
Low1
not blocked1
No public exploit1
20084
Not applicable4
High3
Medium1
not blocked4
No public exploit4
20094
Not applicable4
High1
Low3
not blocked4
No public exploit4
201017
Not applicable17
High1
Medium7
Low9
not blocked17
Exploited2
Working exploit published5
No public exploit10
201110
Not applicable10
High4
Medium5
Low1
not blocked10
Exploited2
No public exploit8
201258
No exploit published1
Outside Waratek scope3
Not applicable54
Critical2
High39
Medium16
Low1
not blocked58
Exploited2
Working exploit published4
No public exploit52
201358
Outside Waratek scope1
Not applicable57
Critical7
High28
Medium22
Low1
not blocked58
Exploited3
Working exploit published4
No public exploit51
201475
Outside Waratek scope8
Not applicable67
Critical10
High18
Medium42
Low5
not blocked75
Exploited4
Working exploit published1
Proof of concept only1
Forecast only2
No public exploit67
201562
No exploit published2
Outside Waratek scope11
Not applicable49
Critical1
High21
Medium29
Low11
not blocked62
Exploited3
Working exploit published1
Proof of concept only1
Forecast only1
No public exploit56
201681
Protected by Waratek2
No exploit published2
Outside Waratek scope2
Not applicable75
Critical13
High25
Medium42
Low1
blocked by ARMR today2
not blocked79
Exploited4
Working exploit published12
Forecast only2
No public exploit63
201735
Not applicable35
Critical11
High17
Medium7
not blocked35
Working exploit published1
No public exploit34
20187
Outside Waratek scope2
Not applicable5
Critical2
High2
Medium3
not blocked7
Exploited1
Forecast only1
No public exploit5
201912
Outside Waratek scope2
Not applicable10
Critical1
High6
Medium5
not blocked12
No public exploit12
202042
Outside Waratek scope3
Not applicable39
Critical3
High21
Medium16
Low2
not blocked42
Working exploit published1
Proof of concept only2
No public exploit39
202168
No exploit published1
Outside Waratek scope8
Not applicable59
Critical11
High43
Medium11
Low3
not blocked68
Exploited2
Forecast only3
No public exploit63
202256
No exploit published1
Outside Waratek scope4
Not applicable51
Critical8
High32
Medium16
not blocked56
Exploited1
Working exploit published3
No public exploit52
202373
Not applicable73
Critical13
High40
Medium18
Low2
not blocked73
Proof of concept only8
No public exploit65
202481
Protected by Waratek1
Not applicable80
Critical9
High39
Medium32
Low1
blocked by ARMR today1
not blocked80
Exploited1
Proof of concept only17
No public exploit63
2025122
Outside Waratek scope3
Not applicable119
Critical14
High48
Medium60
not blocked122
Proof of concept only4
No public exploit118
202629
Not applicable29
Critical1
High13
Medium15
not blocked29
Proof of concept only1
No public exploit28
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-47856 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-47677 | High | 2024-07-08 | Not applicable | Proof of concept only | A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network request can lead to CSRF. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2023-45742 | High | 2024-07-08 | Not applicable | No public exploit | An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-45215 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-41251 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2023-34435 | High | 2024-07-08 | Not applicable | No public exploit | A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2024-20073 | Medium | 2024-06-03 | Not applicable | No public exploit | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00367704; Issue ID: MSV-1411. |
| CVE-2024-20072 | Medium | 2024-06-03 | Not applicable | No public exploit | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364732; Issue ID: MSV-1332. |
| CVE-2024-20071 | Medium | 2024-06-03 | Not applicable | No public exploit | In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364733; Issue ID: MSV-1331. |
| CVE-2024-27243 | Medium | 2024-05-15 | Not applicable | No public exploit | Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-38264 | High | 2024-05-14 | Protected by Waratek | No public exploit | The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578. |
| CVE-2023-27334 | High | 2024-05-03 | Not applicable | No public exploit | Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498. |
| CVE-2024-21421 | High | 2024-03-12 | Not applicable | No public exploit | Azure SDK Spoofing Vulnerability |
| CVE-2024-20018 | Critical | 2024-03-04 | Not applicable | No public exploit | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00348479; Issue ID: MSV-1019. |
| CVE-2024-20017 | Critical | 2024-03-04 | Not applicable | Proof of concept only | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132. |
| CVE-2024-22473 | High | 2024-02-21 | Not applicable | No public exploit | TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0. |
| CVE-2024-1608 | Critical | 2024-02-20 | Not applicable | No public exploit | In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction. |
| CVE-2023-45318 | Critical | 2024-02-20 | Not applicable | Proof of concept only | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2024-0240 | Medium | 2024-02-15 | Not applicable | No public exploit | A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop. |
| CVE-2024-24698 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. |
| CVE-2024-24697 | High | 2024-02-14 | Not applicable | No public exploit | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-24696 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-24695 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-24691 | Critical | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. |
| CVE-2024-24690 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-36493 | High | 2024-02-14 | Not applicable | No public exploit | Uncontrolled search path in some Intel(R) SDK for OpenCL(TM) Applications software may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-6874 | High | 2024-02-05 | Not applicable | No public exploit | Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number |
| CVE-2023-6387 | High | 2024-02-02 | Not applicable | No public exploit | A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution |
| CVE-2023-49647 | High | 2024-01-12 | Not applicable | No public exploit | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2023-5138 | Medium | 2024-01-03 | Not applicable | No public exploit | Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B. |
| CVE-2023-4280 | Critical | 2024-01-02 | Not applicable | No public exploit | An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region. |
| CVE-2023-32831 | Medium | 2024-01-02 | Not applicable | No public exploit | In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00325055; Issue ID: MSV-868. |
| CVE-2023-51651 | Medium | 2023-12-22 | Not applicable | No public exploit | AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1. |
| CVE-2023-41097 | High | 2023-12-21 | Not applicable | No public exploit | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0. |
| CVE-2023-5310 | Medium | 2023-12-15 | Not applicable | No public exploit | A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier. This attack can be carried out only by devices on the network sending a stream of packets to the device. |
| CVE-2023-4020 | Critical | 2023-12-15 | Not applicable | No public exploit | An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory. |
| CVE-2023-41151 | High | 2023-12-14 | Not applicable | No public exploit | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wants to send an error packet, while socket is blocked on writing. |
| CVE-2023-49646 | Medium | 2023-12-13 | Not applicable | No public exploit | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-43586 | High | 2023-12-13 | Not applicable | No public exploit | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2023-43585 | High | 2023-12-13 | Not applicable | No public exploit | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2023-43583 | Medium | 2023-12-13 | Not applicable | No public exploit | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access. |
| CVE-2023-35625 | Medium | 2023-12-12 | Not applicable | No public exploit | Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability |
| CVE-2023-42572 | Medium | 2023-12-05 | Not applicable | No public exploit | Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information. |
| CVE-2021-27504 | High | 2023-11-21 | Not applicable | No public exploit | Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution. |
| CVE-2021-27502 | High | 2023-11-21 | Not applicable | No public exploit | Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution. |
| CVE-2021-27429 | High | 2023-11-20 | Not applicable | No public exploit | Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution. |
| CVE-2021-22636 | High | 2023-11-20 | Not applicable | No public exploit | Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution. |
| CVE-2023-39206 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39205 | Medium | 2023-11-14 | Not applicable | No public exploit | Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39204 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-31247 | Critical | 2023-11-14 | Not applicable | Proof of concept only | A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2023-28391 | Critical | 2023-11-14 | Not applicable | Proof of concept only | A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2023-28379 | Critical | 2023-11-14 | Not applicable | Proof of concept only | A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2023-27882 | Critical | 2023-11-14 | Not applicable | Proof of concept only | A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2023-25181 | Critical | 2023-11-14 | Not applicable | Proof of concept only | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network packets can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2023-24585 | Critical | 2023-11-14 | Not applicable | No public exploit | An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to memory corruption. An attacker can send a network request to trigger this vulnerability. |
| CVE-2023-46729 | Critical | 2023-11-10 | Not applicable | No public exploit | sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0. |
| CVE-2023-3024 | Medium | 2023-09-29 | Not applicable | No public exploit | Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access. |
| CVE-2023-39215 | High | 2023-09-12 | Not applicable | No public exploit | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39743 | Medium | 2023-08-17 | Not applicable | Proof of concept only | lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c. |
| CVE-2023-32663 | High | 2023-08-11 | Not applicable | No public exploit | Incorrect default permissions in some Intel(R) RealSense(TM) SDKs in version 2.53.1 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-29151 | High | 2023-08-11 | Not applicable | No public exploit | Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-38210 | Medium | 2023-08-10 | Not applicable | No public exploit | Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2023-39217 | High | 2023-08-08 | Not applicable | No public exploit | Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access. |
| CVE-2023-39214 | High | 2023-08-08 | Not applicable | No public exploit | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access. |
| CVE-2023-39210 | Medium | 2023-08-08 | Not applicable | No public exploit | Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access. |
| CVE-2023-36533 | High | 2023-08-08 | Not applicable | No public exploit | Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access. |
| CVE-2023-3488 | Medium | 2023-07-28 | Not applicable | No public exploit | Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file. |
| CVE-2023-34117 | Low | 2023-07-11 | Not applicable | No public exploit | Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access. |
| CVE-2023-36539 | High | 2023-06-30 | Not applicable | No public exploit | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
| CVE-2023-3110 | Critical | 2023-06-21 | Not applicable | No public exploit | Description: A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution. |
| CVE-2023-2747 | Medium | 2023-06-15 | Not applicable | No public exploit | The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized. |
| CVE-2023-2686 | Critical | 2023-06-15 | Not applicable | No public exploit | Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack. |
| CVE-2023-2683 | Medium | 2023-06-15 | Not applicable | No public exploit | A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection attempts to fail. A reset of the device immediately clears the error. |
| CVE-2023-2687 | Low | 2023-06-02 | Not applicable | No public exploit | Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap. |
| CVE-2023-32100 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_se_driver_mac_compute in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-32099 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-32098 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_se_sign_message in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-32097 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_crypto_transparent_aead_decrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-32096 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_crypto_transparent_aead_encrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-2481 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-1132 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_se_driver_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-0965 | High | 2023-05-18 | Not applicable | No public exploit | Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. |
| CVE-2023-28131 | Critical | 2023-04-24 | Not applicable | No public exploit | A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc). |
| CVE-2023-27911 | High | 2023-04-17 | Not applicable | No public exploit | A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution. |
| CVE-2023-27910 | High | 2023-04-17 | Not applicable | No public exploit | A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution. |
| CVE-2023-27909 | High | 2023-04-17 | Not applicable | No public exploit | An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure. |
| CVE-2023-0775 | Medium | 2023-03-28 | Not applicable | No public exploit | An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests, resulting in a denial-of-service. |
| CVE-2023-28117 | High | 2023-03-22 | Not applicable | No public exploit | Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application. In order for these sensitive values to be leaked, the Sentry SDK configuration must have `sendDefaultPII` set to `True`; one must use a custom name for either `SESSION_COOKIE_NAME` or `CSRF_COOKIE_NAME` in one's Django settings; and one must not be configured in one's organization or project settings to use Sentry's data scrubbing features to account for the custom cookie names. As of version 1.14.0, the Django integration of the `sentry-sdk` will detect the custom cookie names based on one's Django settings and will remove the values from the payload before sending the data to Sentry. As a workaround, use the SDK's filtering mechanism to remove the cookies from the payload that is sent to Sentry. For error events, this can be done with the `before_send` callback method and for performance related events (transactions) one can use the `before_send_transaction` callback method. Those who want to handle filtering of these values on the server-side can also use Sentry's advanced data scrubbing feature to account for the custom cookie names. Look for the `$http.cookies`, `$http.headers`, `$request.cookies`, or `$request.headers` fields to target with a scrubbing rule. |
| CVE-2023-1261 | High | 2023-03-21 | Not applicable | No public exploit | Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network. |
| CVE-2022-37329 | High | 2023-02-16 | Not applicable | No public exploit | Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2022-36289 | Medium | 2023-02-16 | Not applicable | No public exploit | Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access. |
| CVE-2022-35883 | Medium | 2023-02-16 | Not applicable | No public exploit | NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access. |
| CVE-2022-34841 | High | 2023-02-16 | Not applicable | No public exploit | Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2022-34346 | High | 2023-02-16 | Not applicable | No public exploit | Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2022-34157 | High | 2023-02-16 | Not applicable | No public exploit | Improper access control in the Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software before version 22.1 may allow authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2022-27170 | High | 2023-02-16 | Not applicable | No public exploit | Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-22943 | Medium | 2023-02-14 | Not applicable | No public exploit | In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs. |
| CVE-2022-31364 | High | 2023-02-01 | Not applicable | Proof of concept only | Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is lower_transport_layer_on_seg. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered by sending a series of segmented packets with inconsistent SegN. |
| CVE-2022-31363 | High | 2023-02-01 | Not applicable | Proof of concept only | Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is pb_transport_handle_frag_. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered during mesh provisioning. Because there is no check for mismatched SegN and TotalLength in Transaction Start PDU. |