| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector. |
| Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
| In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services. |
| In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string the application retrieves, or fault on targets with memory protection. |
| In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option. |
| In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code. |
| Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium) |
| Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| Missing authorization in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| Missing authorization in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| Incorrect authorization in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| Improper input validation in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
